CVE-2026-66920: Pivotick Uncontrolled Recursion DoS Flaw

CVE-2026-66920 Overview

CVE-2026-66920 is an uncontrolled-recursion vulnerability in Pivotick that affects graph algorithm processing and the JSON viewer component. The graph algorithms recursively traverse caller-supplied edges, while the JSON viewer recursively descends through each level of a node's data structure. A specially crafted graph with an excessively long path, deeply nested properties, or circular object references exhausts the JavaScript call stack. This leads to an uncaught exception, a frozen page, or a browser tab crash when Pivotick calculates a layout or renders a node in the inspection modal. The flaw is a client-side denial of service and carries no confidentiality or integrity impact [CWE-400].

Critical Impact
Attackers who supply crafted graph data can crash the browser tab or freeze the Pivotick interface, producing a client-side denial of service.

Affected Products

Pivotick (graph analytics and visualization library)
Pivotick DAGAlgorithms module (src/plugins/analytics/DAGAlgorithms.ts)
Pivotick cycle detection module (src/plugins/analytics/cycle.ts) and JSON inspection modal

Discovery Timeline

2026-07-28 - CVE-2026-66920 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66920

Vulnerability Analysis

Pivotick is a graph analytics and visualization tool that processes user-supplied graph data structures. Two subsystems trust the shape of caller-supplied data and recurse without bounds. The first is the analytics layer, where functions such as findMaxReachabilityRoot and the cycle-detection depth-first search recursively walk graph edges. The second is the JSON viewer, which recursively renders each level of a node's properties when displayed in the inspection modal.

When the graph contains a long simple path, the recursive depth-first search pushes one JavaScript stack frame per node. When node data contains deeply nested objects or circular references, the JSON renderer descends without termination checks. Both patterns exhaust the JavaScript engine's call stack and throw a RangeError: Maximum call stack size exceeded. The result is an uncaught exception that freezes the affected page or crashes the browser tab.

Root Cause

The root cause is missing bounds on recursive traversals over attacker-controlled data. The cycle detection routine used a recursive dfs closure whose depth is a direct function of graph path length. The reachability calculation is O(V·E) with both counts drawn from caller input. The JSON viewer descended into object properties without depth limits or cycle detection, allowing circular references to loop indefinitely and nested structures to blow the stack.

Attack Vector

Exploitation requires the victim to load or interact with attacker-controlled graph data in Pivotick. The attacker crafts a graph containing an excessively long path, deeply nested node properties, or circular object references. When the victim triggers layout calculation or opens a node in the inspection modal, the recursive routine exhausts the call stack. User interaction is required, and impact is limited to availability of the browser tab.

typescript

// Security patch in src/plugins/analytics/cycle.ts
// Replaces recursive DFS with an iterative stack-based implementation
const visited = new Set<string>()
// Nodes on the path currently being explored: reaching one again is a back edge.
const onPath = new Set<string>()
// Explicit stack of (node, index of its next unexplored neighbour) frames. A recursive
// DFS overflows the call stack on a long path, and path length follows the caller's data.
const stack: Array<{ id: string, next: number }> = []

for (const node of nodes) {
    if (visited.has(node.id)) continue

    visited.add(node.id)
    onPath.add(node.id)
    stack.push({ id: node.id, next: 0 })

    while (stack.length > 0) {
        const frame = stack[stack.length - 1]
        // ... iterative traversal continues here
    }
}
// Source: https://github.com/Pivotick/Pivotick/commit/66373141eb7892fc29a3b42cfb2c160af16765fe

The companion patch in DAGAlgorithms.ts introduces MAX_REACHABILITY_TRAVERSALS = 1_000_000 to cap the all-pairs reachability search. See the Pivotick security commit for the complete diff.

Detection Methods for CVE-2026-66920

Indicators of Compromise

Browser tab crashes or RangeError: Maximum call stack size exceeded exceptions logged by Pivotick during graph rendering or JSON inspection.
Graph inputs containing paths longer than several thousand nodes, nested JSON structures exceeding 64 levels, or objects with self-referential properties.
Sudden unresponsiveness of the Pivotick page immediately after loading a caller-supplied graph or opening a node in the inspection modal.

Detection Strategies

Instrument the Pivotick host application with client-side error reporting to capture stack-overflow exceptions and correlate them with the graph payload that triggered them.
Inspect graph payloads at ingest for structural anomalies including excessive path length, JSON nesting depth over 64, and circular object references.
Review upstream data sources feeding Pivotick for untrusted graph submissions and validate schemas before rendering.

Monitoring Recommendations

Monitor browser telemetry and JavaScript error logs for repeated RangeError events originating in Pivotick modules.
Track render-time performance metrics; sustained unresponsiveness in layout or JSON inspection is a leading indicator.
Alert on Pivotick deployments still running versions prior to commit 66373141eb7892fc29a3b42cfb2c160af16765fe.

How to Mitigate CVE-2026-66920

Immediate Actions Required

Upgrade Pivotick to a version that includes commit 66373141eb7892fc29a3b42cfb2c160af16765fe, which replaces recursive traversals with iterative implementations.
Restrict Pivotick to trusted graph sources until the patch is deployed, and reject caller-supplied graphs from unauthenticated users.
Enforce input validation at the application boundary to reject graphs with excessive depth, path length, or circular references.

Patch Information

The upstream fix is published in the Pivotick repository at commit 66373141eb7892fc29a3b42cfb2c160af16765fe. The patch replaces recursive graph traversals with iterative stack-based implementations, caps the reachability calculation at 1,000,000 edge traversals, limits JSON rendering to 64 levels of nesting, and detects circular references before descending further into an object. See the GitHub commit details for the full diff.

Workarounds

Pre-validate graph inputs to cap the number of nodes and edges, maximum path length, and JSON nesting depth before passing data to Pivotick.
Reject or sanitize node data containing circular object references prior to rendering in the inspection modal.
Isolate Pivotick in a sandboxed browsing context so a tab crash does not affect the parent application.

bash

# Update to a patched Pivotick build that includes the security commit
npm update pivotick

# Verify the installed version contains the fix commit
npm ls pivotick
git -C node_modules/pivotick log --oneline | grep 66373141