CVE-2026-72912 CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed recipe= URL fragment containing a large number of unmatched quote characters reaches...

CVE-2026-72912 CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed recipe= URL fragment containing a large number of unmatched quote characters reaches...

CVE-2026-72912

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed recipe= URL fragment containing a large number of unmatched quote characters reaches...

CVE-2026-72912

CVE-2026-72912 affects CyberChef (web app). The vulnerability lies in the pretty-recipe parser in src/core/Utils.mjs, where a malformed #recipe= URL fragment with many unmatched quote characters triggers a heavy backtracking path in a complex global regular expression. This causes client-side CPU...

PT-2026-69980

Name of the Vulnerable Software and Affected Versions CyberChef versions prior to 11.3.0 Description The pretty-recipe parser in src/core/Utils.mjs can cause client-side CPU exhaustion when processing a malformed recipe= URL fragment containing numerous unmatched quote characters. This occurs whe...