Executive brief
PapaParse is a JavaScript library widely used for parsing CSV files and data. A flaw in its number-detection regular expression allows an attacker to cause a severe denial of service by providing specially crafted input that triggers catastrophic backtracking, making the application unresponsive for extended periods. This could disrupt services that rely on PapaParse for data processing.
Technical details
The vulnerability is a ReDoS (Regular Expression Denial of Service) flaw in the FLOAT regex pattern used to detect numeric values during CSV parsing. The vulnerable pattern (\d*\.?\d+|\d+\.?\d*) exhibits exponential backtracking when faced with input like repeated zeros followed by a non-digit character. An unauthenticated attacker can trigger the vulnerability remotely by submitting specially crafted CSV data to any service using PapaParse with dynamicTyping enabled. The fix, released in version 5.2.0, replaces the problematic regex with an optimized pattern that eliminates the catastrophic backtracking condition.
Affected products
- mholt PapaParse before 5.2.0
Timeline
- 2020-04-02: disclosed: Issue reported on GitHub
- 2023-01-11: patched: Fix released in version 5.2.0
- 2023-01-11: advisory: GHSA-798h-g4j5-5537 published; later marked as duplicate of GHSA-qvjc-g5vr-mfgr
- 2025-06-16: other: Advisory withdrawn as duplicate