Untrusted URL state reached a synchronous parser during startup.
CyberChef supports shareable recipes through the URL fragment. On page load, the application decodes the #recipe= value and parses its human-readable “pretty recipe” form locally in the browser.
The affected parser used a complex global regular expression. A malformed recipe containing many unmatched quote characters could force the expression engine into increasingly expensive backtracking before parsing failed. Because the work ran synchronously during startup, the browser’s main thread could stall and the tab could become unresponsive.
A shared link was sufficient to reach the expensive path.
URL fragments are not sent to the server in the HTTP request, but they are available to client-side JavaScript. CyberChef intentionally consumes this local state to restore shared recipes. That made the parsing path reachable when a user opened a crafted link.
No additional interaction inside the application was required after navigation. The resource cost occurred in the victim’s browser and varied with payload size and device performance.
Ambiguous repetition created a costly failure case.
The pretty-recipe grammar allowed quoted arguments, escaped characters, unquoted content, and optional suffixes inside one expression. With a long sequence of unmatched quote characters, the engine could explore many competing ways to partition the same input before determining that no complete match existed.
// Shape only — keep validation inputs deliberately small
const malformedRecipe = "A(" + "'".repeat(boundedCount);
const fragment = "#recipe=" + encodeURIComponent(malformedRecipe);Valid quoted input remained fast in the public testing, while the malformed failure path grew disproportionately. That contrast is characteristic of regex complexity problems: routine cases can mask a worst-case path until an adversarial input shape is tested.
The browser tab—not the CyberChef server—absorbed the cost.
| Security property | Observed scope |
|---|---|
| Availability | Browser tab can stall or freeze |
| Confidentiality | No data exfiltration identified |
| Integrity | No data modification identified |
| Execution | No code execution identified |
| Server resources | Parsing occurs client-side |
The practical delay depends on the crafted input and the user’s hardware and browser. Since the parser ran during load, a user could experience the issue before reaching normal application controls.
Update to the fixed release and avoid vulnerable parser paths.
The official advisory lists CyberChef versions through 11.2.0 as affected and 11.3.0 as patched. It records the fix as present on the master branch and in the patched release.
Because the public advisory does not document a specific patch mechanism, this analysis does not infer one. The defensible operational action is to upgrade to 11.3.0 or later and ensure any deployed static CyberChef build is replaced rather than relying on browser cache.
Measure bounded cases without freezing the environment.
The public report includes a standalone parser benchmark, but reproducing very large cases is unnecessary for validation and can make a development process or browser unresponsive. Start with small, capped inputs in an isolated checkout and compare malformed input with a valid control.
const cases = [50, 100, 200]; // bounded local values
for (const count of cases) {
const sample = "A(" + "'".repeat(count);
// Time only the local parser call in a disposable environment.
}Stop if latency rises sharply. Do not distribute crafted links or test against systems you do not own. Version comparison should use the same environment and small inputs so the result demonstrates parser behavior without creating an availability event.
The official advisory identifies Zain Nadeem as reporter.
GitHub’s public advisory record credits zainnadeem786 as reporter. The report identified the URL-driven parsing path, isolated the malformed input shape, distinguished client-side availability from unrelated impact classes, and supplied maintainers with a controlled reproduction.
This article does not claim patch authorship because the public advisory does not establish that role.
Client-side input handling deserves server-grade failure testing.
- URL fragments are untrusted input even though browsers do not send them to the server.
- Regex reviews should include malformed failure cases, not only valid examples and average-case throughput.
- Synchronous parsing on the main thread makes complexity defects directly visible as interface availability failures.
- Security reports should state where resource consumption occurs and avoid implying server-side impact when execution is local to the browser.