Description

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #recipe= URL fragment containing a large number of unmatched quote characters reaches Utils.parseRecipeConfig(). The function synchronously applies a complex global regular expression that may perform heavy backtracking before rejecting the input, causing the victim's browser tab to freeze during startup for seconds or longer. No code execution, data exfiltration, or privilege escalation occurs. This issue is fixed in version 11.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-10T21:17:26.130Z",
  "pubdate": "2026-08-10T21:17:26.130Z",
  "executiveSummary": "A Regular Expression Denial of Service (ReDoS) vulnerability exists in the CyberChef web application prior to version 11.3.0.\nThe vulnerability is triggered when processing a crafted #recipe= URL fragment containing a large number of unmatched quote characters, leading to excessive client-side CPU resource exhaustion.\nThe primary impact is a synchronous browser tab freeze lasting several seconds or longer during application startup, effectively causing a Denial of Service (DoS) for the user.\nAffected systems include the CyberChef web application running versions prior to 11.3.0.\nThe risk implications are limited to client-side availability degradation; no remote code execution, data exfiltration, or privilege escalation occurs.\nAn attacker can exploit this vulnerability by tricking a victim into navigating to a maliciously crafted URL.\nExploitation requires no authentication, privileges, or prior network positioning, relying solely on client-side interaction with a malicious hyperlink.",
  "technicalDetails": "The root cause of the vulnerability resides in the pretty-recipe parser located in src/core/Utils.mjs, specifically within the Utils.parseRecipeConfig() function.\nWhen the application parses the #recipe= URL fragment, it synchronously applies a complex global regular expression designed to analyze the recipe configuration structure.\nWhen presented with malformed input consisting of a dense sequence of unmatched quote characters, this regular expression experiences catastrophic backtracking.\nCatastrophic backtracking forces the JavaScript engine to exhaust single-threaded CPU resources as it attempts to resolve the ambiguous pattern matching.\nThe attack flow proceeds as follows: First, an attacker constructs a malicious URL incorporating a specially crafted #recipe= fragment packed with unmatched quote symbols. Second, the attacker induces a victim to open this URL within their browser. Third, upon initialization, CyberChef reads the URL fragment and passes it to Utils.parseRecipeConfig(). Fourth, the vulnerable global regular expression executes against the malformed input synchronously on the main UI thread. Fifth, the resulting heavy backtracking locks the client-side CPU, freezing the browser tab completely for seconds or longer.\nThe vulnerable component is the recipe configuration parsing logic within src/core/Utils.mjs.\nAffected versions include all CyberChef deployments prior to version 11.3.0.\nThe vulnerability requires no authentication or privileges, as it is triggered entirely via client-side processing of unauthenticated input vectors exposed through the browser's URL fragment.\nNetwork exposure is inherent to any deployment of the vulnerable web application where users can be directed via external links containing crafted URL parameters.\nThe payload behavior is strictly localized to client-side CPU resource exhaustion, resulting in temporary unresponsiveness of the affected browser context without persisting malicious artifacts or altering backend states.\nPost-exploitation impact is non-existent beyond the temporary denial of service, as the flaw does not facilitate code execution, memory corruption, or unauthorized data access."
}