CVE-2026-72912

Name of the Vulnerable Software and Affected Versions CyberChef versions prior to 11.3.0

Description The pretty-recipe parser in src/core/Utils.mjs can cause client-side CPU exhaustion when processing a malformed #recipe= URL fragment containing numerous unmatched quote characters. This occurs when the Utils.parseRecipeConfig() function applies a complex global regular expression that performs heavy backtracking, leading to the browser tab freezing during startup. This is a Regular Expression Denial of Service (ReDoS), where a specially crafted input causes the regex engine to take an exponential amount of time to process.

Recommendations Update to version 11.3.0.