PapaParse CSV parsing DoS before 5.7.1 (CVE-2026-127056)

high severity · published 2026-11-12

A remote unauthenticated attacker can cause denial of service against any app or service that parses untrusted CSV with PapaParse. The parsing cost grows quadratically with input size, exhausting CPU and blocking the Node.js event loop or freezing a browser tab.

Fixed in: 5.7.1

CVE: CVE-2026-127056

Source: NVD

Am I affected?

You are affected if the installed version is older than 5.7.1. Check the version you have and update to 5.7.1 or later. The fixed version is verified against a vendor or advisory source.

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 2590 and your operating system.