CVE-2026-72912: CyberChef DoS Vulnerability

CVE-2026-72912 Overview

CyberChef is a widely used web application for encryption, encoding, compression, and data analysis. CVE-2026-72912 is a client-side denial-of-service vulnerability in the pretty-recipe parser located in src/core/Utils.mjs. A malformed #recipe= URL fragment containing a large number of unmatched quote characters triggers catastrophic backtracking in a global regular expression evaluated by Utils.parseRecipeConfig(). The result is CPU exhaustion that freezes the victim's browser tab for seconds or longer during startup. The issue is classified as a Regular Expression Denial of Service (ReDoS) under [CWE-400]. It is fixed in CyberChef version 11.3.0.

Critical Impact
A crafted CyberChef link causes the victim's browser tab to freeze on load. No code execution, data exfiltration, or privilege escalation occurs.

Affected Products

GCHQ CyberChef prior to 11.3.0
The src/core/Utils.mjs pretty-recipe parser component
Any hosted or self-hosted CyberChef deployment on vulnerable versions

Discovery Timeline

2026-08-10 - CVE-2026-72912 published to NVD
2026-08-12 - Last updated in NVD database
Fixed version - CyberChef 11.3.0 released with parser validation patch

Technical Details for CVE-2026-72912

Vulnerability Analysis

The flaw is a Regular Expression Denial of Service condition in CyberChef's recipe parser. When a user visits a CyberChef URL, the client parses the #recipe= fragment during page startup. Utils.parseRecipeConfig() applies a complex global regular expression that matches recipe operations and their quoted arguments. When the input contains a large number of unmatched single-quote characters, the regex engine explores exponentially many backtracking paths before failing. The parser runs synchronously on the main thread, so the browser tab becomes unresponsive until evaluation completes. Impact is limited to availability of the current tab; no confidentiality or integrity boundaries are crossed.

Root Cause

The root cause is an unbounded, unvalidated input reaching a regex with alternation and nested quantifiers over quoted string content. The pattern ((?:'[^'\\]*(?:\\.[^'\\]*)*'|[^)/'])*) permits multiple ways to match the same characters when quotes are unbalanced, producing catastrophic backtracking. The parser did not pre-validate quote balance before invoking the regex.

Attack Vector

Exploitation requires user interaction: the victim must open a maliciously crafted CyberChef URL. The attack vector is network-based, delivered through phishing links, chat messages, social media, or embedded page redirects. On page load the malicious #recipe= fragment is parsed and the browser tab freezes.

text

         // Parse bespoke recipe format
         recipe = recipe.replace(/\n/g, "");
+        Utils._validatePrettyRecipe(recipe);
         let m, args;
         const recipeRegex = /([^(]+)\(((?:'[^'\\]*(?:\\.[^'\\]*)*'|[^)/'])*)(\/[^)]+)?\)/g,
             recipeConfig = [];
// Source: https://github.com/gchq/CyberChef/commit/f77ddf489050b339faa978bb28da954bafd289ae
// The patch inserts a call to Utils._validatePrettyRecipe(recipe) that rejects malformed input (including unmatched quotes) before the vulnerable regex runs.

Detection Methods for CVE-2026-72912

Indicators of Compromise

Inbound URLs pointing to CyberChef instances that contain a #recipe= fragment with an unusually high count of unmatched single-quote characters.
User reports of CyberChef browser tabs hanging or becoming unresponsive during page load.
Web proxy or browser telemetry showing long main-thread stalls on CyberChef page loads.

Detection Strategies

Inspect HTTP referrer and URL logs for CyberChef links with abnormally long or malformed #recipe= fragments containing repeated ' characters.
Deploy web content filtering rules that flag CyberChef URLs whose fragment length or quote-density exceeds a defined threshold.
Correlate endpoint browser performance events with visits to CyberChef domains to identify DoS attempts.

Monitoring Recommendations

Monitor phishing and messaging channels for links pointing to CyberChef with suspicious fragments.
Track deployed CyberChef versions across internal hosting and developer workstations to confirm all instances are on 11.3.0 or later.
Review web application logs for repeated crafted requests targeting hosted CyberChef instances.

How to Mitigate CVE-2026-72912

Immediate Actions Required

Upgrade all CyberChef deployments and bundled copies to version 11.3.0 or later.
Audit internal documentation, wikis, and browser bookmarks for pinned CyberChef URLs and validate they resolve to a patched instance.
Warn analysts against opening untrusted CyberChef #recipe= links until upgrades are complete.

Patch Information

The fix is delivered in CyberChef 11.3.0. The patch adds a Utils._validatePrettyRecipe(recipe) pre-check in src/core/Utils.mjs that rejects malformed pretty-recipe input before the vulnerable regex executes. See the GitHub Security Advisory GHSA-w74r-jxjh-gwr6, the GitHub Release v11.3.0, and the upstream commit for details.

Workarounds

If immediate upgrade is not possible, restrict CyberChef access to trusted users and prevent loading of unvetted #recipe= links.
Front hosted CyberChef instances with a reverse proxy that rejects requests whose URL fragments exceed a length or quote-count threshold. Note that fragments are not sent to the server by default, so this only helps when the recipe is passed via query string.
Educate users to close the browser tab if CyberChef hangs during startup rather than waiting for the parser to complete.

bash

# Upgrade a self-hosted CyberChef deployment to the patched release
git fetch --tags
git checkout v11.3.0
npm ci
npm run build

# Verify the installed version
grep '"version"' package.json