Read the docs
TI-2026-51128 Aliases CVE-2026-72912

CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL

Priority LOW 20CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1333.

Summary

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #recipe= URL fragment containing a large number of unmatched quote characters reaches Utils.parseRecipeConfig(). The function synchronously applies a complex global regular expression that may perform heavy backtracking before rejecting the input, causing the victim's browser tab to freeze during startup for seconds or longer. No code execution, data exfiltration, or privilege escalation occurs. This issue is fixed in version 11.3.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00315 24th percentileScored 2026-11-07
Fix Fixed CyberChef (gchq): 11.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gchqCyberChefbefore 11.3.011.3.0Patch availableCNA
  • CyberChef Vendorgchq Affected before 11.3.0 Fixed in 11.3.0 Patch available CNA

Remediation

  • Fix · CNA CyberChef (gchq) Fixed in 11.3.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-72912

References

Other 4

  • TI-2026-41376 CyberChef: Prototype pollution in Series Chart operation CVSS 3.1MEDIUM 5.0
  • TI-2025-18851 Stroom Authentication/Authorization Bypass when using AWS ALB CVSS 3.1CRITICAL 9.4
  • TI-2018-16004 Stroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser… CVSS 3.0CRITICAL 10.0
  • TI-2026-30894 Cross-site scripting in gchq CyberChef CVSS 3.1HIGH 7.2
  • TI-2019-11632 CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs. CVSS 3.0MEDIUM 6.1
  • TI-2019-08044 Cross-site scripting in stroom:stroom-app CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences