CVE-2026-72912 in CyberChef
Summary
by MITRE • 08/11/2026
CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #recipe= URL fragment containing a large number of unmatched quote characters reaches Utils.parseRecipeConfig(). The function synchronously applies a complex global regular expression that may perform heavy backtracking before rejecting the input, causing the victim's browser tab to freeze during startup for seconds or longer. No code execution, data exfiltration, or privilege escalation occurs. This issue is fixed in version 11.3.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability exists within CyberChef's recipe parsing functionality where a specially crafted URL fragment can cause significant performance degradation. The issue stems from the pretty-recipe parser implementation in src/core/Utils.mjs which processes URL fragments containing recipe configurations. When malformed URLs with excessive unmatched quote characters are processed, the parser triggers a synchronous operation that employs a complex global regular expression pattern.
This vulnerability represents a classic example of a regular expression denial of service attack where the malicious input causes the regex engine to perform extensive backtracking operations. The function parseRecipeConfig() executes without proper input validation or resource limiting mechanisms, allowing an attacker to craft URLs that force the browser to engage in computationally expensive operations. The synchronous nature of the operation blocks the main execution thread of the browser, leading to complete UI freezing and unresponsiveness.
The impact of this vulnerability extends beyond simple inconvenience as it can render the entire application unusable for extended periods during startup phases. Users attempting to access CyberChef with maliciously constructed URLs will experience browser tab freezes lasting seconds or even minutes, effectively creating a denial of service condition. The attack requires no special privileges or authentication mechanisms since it targets the client-side parsing logic that executes in the user's browser environment.
This vulnerability aligns with CWE-400 which categorizes "Uncontrolled Resource Consumption" and specifically relates to regex denial of service conditions. From an adversarial perspective, this issue maps to ATT&CK technique T1496 which involves resource exhaustion attacks through malicious input processing. The attack vector is particularly concerning as it can be delivered via simple URL manipulation without requiring any server-side infrastructure or complex exploitation techniques.
The fix implemented in version 11.3.0 addresses the core issue by introducing proper input validation and resource limiting measures to prevent excessive backtracking during regex operations. Additionally, the implementation likely incorporates more efficient parsing algorithms that can handle malformed inputs gracefully without blocking the main execution thread. Organizations using CyberChef should immediately upgrade to version 11.3.0 or later to mitigate this vulnerability.
Security practitioners should recognize this as a common pattern in web applications where input processing functions lack proper bounds checking and resource management. The vulnerability demonstrates the importance of defensive programming practices including input sanitization, regex optimization, and asynchronous operation handling to prevent single points of failure in client-side applications. Regular security reviews of parsing logic and input validation routines can help identify similar patterns that may lead to performance degradation or denial of service conditions.