Threats tagged 'ghsa-2m3w-6mh6-8j3w'

PapaParse versions before 5.7.1 have an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service. This occurs when attackers submit delimiter-free quoted CSV input to the Papa.parse() function, triggering repeated full-buffer scans that grow quadratically with input size. The result is CPU exhaustion and blocking of the Node.js event loop or freezing of browser tabs.