# CyberChef: what changed from 10 to 11 - Product: CyberChef (https://whatsnew.fyi/product/cyberchef) - Vendor: gchq - Range: changelog entries numbered after v10.24.0 up to and including v11.4.0, stable releases only - Entries below: 5 releases (newest first) - Resolved: 10 is v10.24.0 and 11 is v11.4.0, the newest stable release of each major we track - Carrying security changes: 5 · CVEs mentioned: 0 · Mentioning breaking changes: 1 · Removing or deprecating something: 0 - Page: https://whatsnew.fyi/product/cyberchef/compare/10...11 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. ## What changed (62 changes, grouped by kind) ### Added #### v11.4.0 (2026-08-18) - Add XPRESS (MS-XCA) decompression operations - Add support for Node 26 - Add Modular Exponentiation operation #### v11.3.0 (2026-07-24) - Add modulo operation - Add Generate Prime Number operation - Add Modular Inverse operation - Add Extended GCD operation - Add COBS encoding/decoding operations - Add TEA and XTEA block ciphers - Add PRESENT and Twofish ciphers - Add Ascon (NIST SP 800-232) operations: Hash, MAC, Encrypt, Decrypt - Add RenderPDF functionality - Add automated parameter validation framework #### v11.2.0 (2026-06-17) - Add integer check for alphabet size #### v11.1.0 (2026-06-13) - Implement ROR13 feature - Add Escape Smart Characters operation - Get AES IV from input - Add remove ANSI escape codes operation - Add new Wrap operation to format text at specified line width ### Changed #### v11.4.0 (2026-08-18) - Extend automated ingredient validation to include argSelector ingredients #### v11.2.0 (2026-06-17) - Update website references #### v11.1.0 (2026-06-13) - Include git ref in website download zip name - Build docker container for arm v7 as well #### v11.0.0 (2026-04-28) - Update Node version from 22 to 24 - Make compatible with Node >=22 - Change to nginx-unprivileged image for better Kubernetes support - Minimum supported Node version is now v24 (was v16) - Exported port on Docker Container is now 8080 (was 80) - Node API now exports bake and execute functions as async ### Fixed #### v11.4.0 (2026-08-18) - Use js-yaml for both JSON to YAML and YAML to JSON - Replace shasum / sha256sum / sed calls with node built-ins - Stop Parse QR Code from participating in Magic - Restrict A1Z26 Magic checks to valid ranges #### v11.3.0 (2026-07-24) - Await Node API operations whose run() returns a non-async Promise - fromDecimal Auto delimiter now correctly parses multiple numbers - Remove stray punctuation from malformed To HTML Entity table values - Support constructor and __proto__ parameters in Parse URI - HOTP and TOTP type errors - Fix base32 unicode alphabet - TOTP input validation for correct otpauth uri generation - Validate Wrap line width - Handle malformed image parser errors in View Bit Plane #### v11.2.0 (2026-06-17) - Add input validation for XOR Checksum blocksize - Fix Reverse highlights unwinding incorrectly - Fix Uint8Array concat crash in Parse IPv4 header - Fix typos and documentation errors - Validate hexdump width upper bound #### v11.1.0 (2026-06-13) - Fix spurious error messages generated during webpack build - Validate text encoding options - Fix option ingredients being overwritten - Fix pgp tests - Fix flaky npm run testui - Series Chart HTML Formatting fix - Parse Ethernet Frame HTML formatting fix - Parse IPv4 Header HTML formatting fix - Fix all zeros after 16384 bytes with Blake3 #### v11.0.0 (2026-04-28) - Enable asynchronous operation support in Node.js API ### Security #### v11.4.0 (2026-08-18) - Patch XSS in Regular expression module #### v11.3.0 (2026-07-24) - Fix pretty recipe parser ReDoS #### v11.2.0 (2026-06-17) - Add prototype protection to Chart operation #### v11.1.0 (2026-06-13) - Add fix and tests for Lorem Ipsum DoS issue #### v11.0.0 (2026-04-28) - Fix XSS vulnerability in Show Base64 offsets ## Release notes ### v11.4.0 - Date: 2026-08-18 - Version: v11.4.0 - Original notes: https://github.com/gchq/CyberChef/releases/tag/v11.4.0 - Permalink: https://whatsnew.fyi/product/cyberchef/releases/v11.4.0 - **security** — Patch XSS in Regular expression module - **added** — Add XPRESS (MS-XCA) decompression operations - **added** — Add support for Node 26 - **added** — Add Modular Exponentiation operation - **fixed** — Use js-yaml for both JSON to YAML and YAML to JSON - **fixed** — Replace shasum / sha256sum / sed calls with node built-ins - **fixed** — Stop Parse QR Code from participating in Magic - **fixed** — Restrict A1Z26 Magic checks to valid ranges - **changed** — Extend automated ingredient validation to include argSelector ingredients This release includes a security fix - Security: patch XSS in Regular expression module [@Ne0re0] - chore (deps): bump @codemirror/view from 6.43.8 to 6.43.9 in the patch-updates group | [#2731] - chore (deps): bump @codemirror/commands from 6.10.4 to 6.11.0 in the minor-updates group | [#2732] - Add XPRESS (MS-XCA) decompression operations [@MP-GOWTHAM] | [#2722] - Feat/node 26 support [@alleria173] | [#2699] - chore(root): update allowlist [@evenstensberg] | [#2713] - chore (deps): bump the patch-updates group across 1 directory with 7 updates | [#2730] - chore (deps): bump the minor-updates group across 1 directory with 9 updates | [#2729] - chore (deps): bump docker/login-action from 4.5.2 to 4.6.0 in the actions-dependencies group | [#2716] - chore (deps): bump node from `a0b9bf0` to `d32cdf6` in the docker-dependencies group | [#2723] - docs(root): improve docs a bit [@evenstensberg] | [#2718] - fix: use js-yaml for both JSON to YAML and YAML to JSON [@bartvanandel] | [#2710] - chore (deps): bump the patch-updates group across 1 directory with 6 updates | [#2712] - chore (deps): bump the minor-updates group across 1 directory with 3 updates | [#2705] - chore (deps): bump the actions-dependencies group with 2 updates | [#2703] - fix: replace `shasum` / `sha256sum` / `sed` calls with node built-ins [@bartvanandel] | [#2019] - chore (deps): bump fast-uri from 3.1.4 to 3.1.5 | [#2709] - chore (deps): bump ip-address from 10.2.0 to 10.4.0 | [#2708] - fix: stop Parse QR Code from participating in Magic (#2610) [@Sanjays2402] | [#2613] - Restrict A1Z26 Magic checks to valid ranges [@vetrovk] | [#2644] - feat: Extend automated ingredient validation to include argSelector ingredients (#2641) [@mansiverma897993] | [#2643] - Add Modular Exponentiation operation [@p-leriche] | [#2149] - Add npm allowScripts policy for npm v12 [@zainnadeem786] | [#2682] - chore (deps): bump assorted vulnerable dependencies [@GCHQDeveloper581] | [#2689] - chore (deps): bump shell-quote from 1.8.4 to 1.10.0 | [#2690] - chore (deps): bump the patch-updates group across 1 directory with 9 updates | [#2686] - chore (deps): bump the actions-dependencies group across 1 directory with 2 updates | [#2685] - chore (deps): bump nginxinc/nginx-unprivileged from `fd3314e` to `44e3633` in the docker-dependencies group | [#2684] ### v11.3.0 - Date: 2026-07-24 - Version: v11.3.0 - Original notes: https://github.com/gchq/CyberChef/releases/tag/v11.3.0 - Permalink: https://whatsnew.fyi/product/cyberchef/releases/v11.3.0 - **security** — Fix pretty recipe parser ReDoS - **added** — Add modulo operation - **added** — Add Generate Prime Number operation - **added** — Add Modular Inverse operation - **added** — Add Extended GCD operation - **added** — Add COBS encoding/decoding operations - **added** — Add TEA and XTEA block ciphers - **added** — Add PRESENT and Twofish ciphers - **added** — Add Ascon (NIST SP 800-232) operations: Hash, MAC, Encrypt, Decrypt - **added** — Add RenderPDF functionality - **added** — Add automated parameter validation framework - **fixed** — Await Node API operations whose run() returns a non-async Promise - **fixed** — fromDecimal Auto delimiter now correctly parses multiple numbers - **fixed** — Remove stray punctuation from malformed To HTML Entity table values - **fixed** — Support constructor and __proto__ parameters in Parse URI - **fixed** — HOTP and TOTP type errors - **fixed** — Fix base32 unicode alphabet - **fixed** — TOTP input validation for correct otpauth uri generation - **fixed** — Validate Wrap line width - **fixed** — Handle malformed image parser errors in View Bit Plane This release includes a security fix ([#2687]) - Security: Fix pretty recipe parser ReDoS [@zainnadeem786] | [#2687] - feat: add modulo operation [@thomasnemer] [@GCHQDeveloper581] | [#2103] - Add HMAC regression tests for Decimal key parsing [@alleria173] | [#2680] - fix: await Node API operations whose run() returns a non-async Promise [@roberson-io] | [#2659] - chore (deps): bump morgan from 1.10.1 to 1.11.0 | [#2676] - fix: fromDecimal Auto delimiter now correctly parses multiple numbers [@min23asdw] | [#2270] - Add Generate Prime Number operation [@p-leriche] | [#2212] - Add Modular Inverse operation [@p-leriche] | [#2207] - Consolidate HTML entity tables into a single spec-generated source (#2645) [@roberson-io] | [#2671] - Add Extended GCD operation [@p-leriche] | [#2206] - Add COBS encoding/decoding operations [@giesmininkas] | [#2185] - chore (deps): bump websocket-driver from 0.7.4 to 0.7.5 | [#2673] - fix: remove stray punctuation from malformed To HTML Entity table values [@roberson-io] | [#2660] - chore (deps): bump the actions-dependencies group across 1 directory with 6 updates | [#2668] - chore (deps): bump the minor-updates group across 1 directory with 3 updates | [#2669] - chore (deps): bump the patch-updates group with 5 updates | [#2654] - feat: add TEA and XTEA block ciphers [@thomasxm] | [#2225] - feat: add PRESENT and Twofish ciphers [@thomasxm] | [#2157] - fix: support constructor and __proto__ parameters in Parse URI (#2578) [@mansiverma897993] | [#2581] - feat: Implement automated option-type ingredient validation [@mansiverma897993] | [#2625] - Add Ascon (NIST SP 800-232) operations: Hash, MAC, Encrypt, Decrypt [@thomasxm] | [#2155] - chore (deps): bump the patch-updates group across 1 directory with 6 updates | [#2638] - chore (deps): bump webpack from 5.107.2 to 5.108.3 in the minor-updates group | [#2635] - chore (deps): bump nginxinc/nginx-unprivileged from `458ecbe` to `fd3314e` in the docker-dependencies group | [#2633] - Feature: automatically expire PRs if CLA remains unsigned for an extended period [@GCHQDeveloper581] | [#2636] - fix/2445 HOTP (and 2426 TOTP) type errors [@alleria173] | [#2620] - Fix base32 unicode alphabet [@loki1205] | [#2380] - Add a workflow to automatically flag PRs without a signed CLA [@GCHQDeveloper581] | [#2627] - fix/2444 TOTP input validation for correct otpauth uri generation [@alleria173] | [#2621] - Validate Wrap line width [@vetrovk] [@GCHQDeveloper581] [@C85297] | [#2606] - Handle malformed image parser errors in View Bit Plane [@zainnadeem786] | [#2612] - Fixes #2446 hotp otpauth uri validation [@alleria173] | [#2614] - Handle invalid bcrypt salt errors in Bcrypt compare [@zainnadeem786] | [#2615] - Validate empty Show On Map options [@vetrovk] | [#2631] - Create AGENTS.md file [@C85297] | [#2619] - Set parameter validation Metadata for GenerateImage operations [@GCHQDeveloper581] | [#2611] - Update 4 vulnerable dependencies [@GCHQDeveloper581] | [#2616] - Fix BigNumber deserialisation in Dish, and add tests [@GCHQDeveloper581] | [#2607] - chore (deps): bump the docker-dependencies group with 2 updates | [#2600] - chore (deps): bump the patch-updates group with 8 updates | [#2602] - chore (deps): bump actions/checkout from 6.0.3 to 7.0.0 in the actions-dependencies group | [#2601] - chore (deps): bump the minor-updates group with 2 updates | [#2603] - Handle empty Generate Image mode [@vetrovk] | [#2598] - Fix stale presenter after expected operation errors [@zainnadeem786] [@GCHQDeveloper581] | [#2589] - Clean up/rationalise webpack paths and thereby increase compatibility for Win… [@GCHQDeveloper581] | [#2585] - Improve parameter validation for a number of operations where exceptions otherwise caused. [@GCHQDeveloper581] | [#2586] - Fix uncaught TypeError in "Show on map" operation. [@lzandman] | [#2453] - fix: jsonata $base64decode/$base64encode in Web Worker [@min23asdw] | [#2275] - fix Dechunk HTTP Response leaks terminating chunk and trail _[Truncated at 4000 characters — full notes: https://github.com/gchq/CyberChef/releases/tag/v11.3.0]_ ### v11.2.0 - Date: 2026-06-17 - Version: v11.2.0 - Original notes: https://github.com/gchq/CyberChef/releases/tag/v11.2.0 - Permalink: https://whatsnew.fyi/product/cyberchef/releases/v11.2.0 - **security** — Add prototype protection to Chart operation - **changed** — Update website references - **fixed** — Add input validation for XOR Checksum blocksize - **fixed** — Fix Reverse highlights unwinding incorrectly - **fixed** — Fix Uint8Array concat crash in Parse IPv4 header - **fixed** — Fix typos and documentation errors - **added** — Add integer check for alphabet size - **fixed** — Validate hexdump width upper bound This release includes a security fix ([#2569]) - Security: Chart operation prototype protection [@C85297] | [#2569] - Update website references [@C85297] | [#2566] - Fix: Add input validation for XOR Checksum blocksize (#2537) [@dweep-js] | [#2542] - Fix: Reverse highlights unwind incorrectly [@kendallgoto] [@C85297] | [#2022] - Fix Uint8Array concat crash in Parse IPv4 header [@Zish19] | [#2409] - Fix typos and documentation errors (bytes→bits, wrong release link, spelling) [@qa2me] [@GCHQDeveloper581] | [#2404] - Add integer check for alphabet size [@heapframe] [@GCHQDeveloper581] | [#2458] - fix: validate hexdump width upper bound [@skyswordw] | [#2514] ### v11.1.0 - Date: 2026-06-13 - Version: v11.1.0 - Original notes: https://github.com/gchq/CyberChef/releases/tag/v11.1.0 - Permalink: https://whatsnew.fyi/product/cyberchef/releases/v11.1.0 - **security** — Add fix and tests for Lorem Ipsum DoS issue - **fixed** — Fix spurious error messages generated during webpack build - **added** — Implement ROR13 feature - **added** — Add Escape Smart Characters operation - **added** — Get AES IV from input - **fixed** — Validate text encoding options - **added** — Add remove ANSI escape codes operation - **fixed** — Fix option ingredients being overwritten - **fixed** — Fix pgp tests - **fixed** — Fix flaky npm run testui - **changed** — Include git ref in website download zip name - **fixed** — Series Chart HTML Formatting fix - **fixed** — Parse Ethernet Frame HTML formatting fix - **fixed** — Parse IPv4 Header HTML formatting fix - **changed** — Build docker container for arm v7 as well - **added** — Add new Wrap operation to format text at specified line width - **fixed** — Fix all zeros after 16384 bytes with Blake3 This release includes a security fix ([#2557]) - Security: Add fix, and tests, for Lorem Ipsum DoS issue [@GCHQDeveloper581] | [#2557] - chore (deps): bump the patch-updates group with 4 updates | [#2552] - chore (deps): bump the actions-dependencies group with 2 updates | [#2551] - chore (deps): bump the docker-dependencies group with 2 updates | [#2550] - chore (deps): bump protobufjs from 8.5.0 to 8.6.2 in the minor-updates group | [#2553] - Security Policy Update [@C85297] | [#2547] - Fix spurious error messages generated during webpack build [@GCHQDeveloper581] | [#2545] - chore (deps): bump shell-quote from 1.8.3 to 1.8.4 | [#2543] - Implementing ROR13 feature [@Fufu-btw] | [#2539] - New operation improvements [@jl5193] [@GCHQDeveloper581] | [#1431] - Npm and yarn/major version updates [@GCHQDeveloper581] | [#2527] - Update README to reflect AES Decrypt changes [@andreasrtv] | [#2502] - feat: add Escape Smart Characters operation [@HarelKatz] | [#2391] - feat: Get AES IV from input (QoL) [@andreasrtv] | [#2471] - fix: validate text encoding options [@SyedIshmumAhnaf] | [#2497] - chore (deps): bump the minor-updates group with 5 updates [@GCHQDeveloper581] | [#2500] - chore (deps): bump the patch-updates group with 2 updates | [#2499] - chore (deps): bump nginxinc/nginx-unprivileged from `df0e9ed` to `0a1e718` in the docker-dependencies group | [#2498] - Add remove ANSI escape codes operation [@Louis-Ladd] [@GCHQDeveloper581] | [#2143] - Fix option ingredients being overwriten [@C85297] | [#2341] - chore (deps): bump qs and express | [#2478] - chore (deps): bump tmp from 0.2.5 to 0.2.7 | [#2479] - chore (deps): bump the patch-updates group across 1 directory with 6 updates | [#2463] - chore (deps): bump the docker-dependencies group across 1 directory with 2 updates | [#2468] - chore (deps): bump terser from 5.46.2 to 5.48.0 | [#2385] - Make dependabot quieter [@GCHQDeveloper581] | [#2467] - update sitemap [@Blank0120] | [#2443] - Bump webpack-dev-server to 5.2.4 [@GCHQDeveloper581] | [#2417] - Fix pgp tests [@GCHQDeveloper581] [@C85297] | [#2461] - chore (deps): bump the patch-updates group across 1 directory with 4 updates | [#2438] - chore (deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 | [#2439] - chore (deps): bump docker/login-action from 4.1.0 to 4.2.0 | [#2441] - chore (deps): bump docker/metadata-action from 6.0.0 to 6.1.0 | [#2442] - update bson [@Blank0120] [@GCHQDeveloper581] | [#2425] - chore (deps): bump webpack from 5.106.2 to 5.107.1 | [#2428] - chore (deps): bump protobufjs from 7.5.8 to 7.6.0 | [#2429] - chore (deps): bump sql-formatter from 15.7.4 to 15.8.0 | [#2430] - chore (deps): bump docker/build-push-action from 7.1.0 to 7.2.0 | [#2431] - Fix flaky `npm run testui` [@lzandman] | [#2412] - Include git ref in website download zip name [@C85297] | [#2339] - Bump nginxinc/nginx-unprivileged from `808f784` to `b9f7ba1` | [#2389] - Series Chart HTML Formatting fix [@C85297] | [#2403] - Parse Ethernet Frame HTML formatting fix [@C85297] | [#2402] - Parse IPv4 Header HTML formatting fix [@C85297] | [#2401] - Update chromedriver, and install corresponding chrome in workflows (fixes build) [@GCHQDeveloper581] | [#2387] - chore (deps): bump @codemirror/view from 6.41.1 to 6.43.0 | [#2384] - chore (deps): bump globals from 17.5.0 to 17.6.0 | [#2386] - chore (deps): bump the patch-updates group across 1 directory with 3 updates | [#2388] - [StepSecurity] Apply security best practices [@GCHQDeveloper581] StepSecurity Bot | [#2378] - Build docker container for arm v7 as well [@GCHQDeveloper581] | [#2379] - chore (deps): bump fast-uri from 3.1.0 to 3.1.2 | [#2372] - update bcryptjs [@C85297] [@GCHQDeveloper581] | [#2368] - chore (deps): bump picomatch from 2.3.1 to 2.3.2 | [#2370] - chore (deps): bump ip-address from 10.1.0 to 10.2.0 | [#2371] - chore (deps): bump axios from 1.15.0 to 1.16.0 | [#2369] - feat(operation-wrap): add new Wrap operation to fo _[Truncated at 4000 characters — full notes: https://github.com/gchq/CyberChef/releases/tag/v11.1.0]_ ### v11.0.0 - Date: 2026-04-28 - Version: v11.0.0 - Original notes: https://github.com/gchq/CyberChef/releases/tag/v11.0.0 - Permalink: https://whatsnew.fyi/product/cyberchef/releases/v11.0.0 - **security** — Fix XSS vulnerability in Show Base64 offsets - **changed** — Update Node version from 22 to 24 - **changed** — Make compatible with Node >=22 - **fixed** — Enable asynchronous operation support in Node.js API - **changed** — Change to nginx-unprivileged image for better Kubernetes support - **changed** — Minimum supported Node version is now v24 (was v16) - **changed** — Exported port on Docker Container is now 8080 (was 80) - **changed** — Node API now exports bake and execute functions as async - Revert sitemap to v8.0.X to fix build/deploy on master [@GCHQDeveloper581] | [#2348] - Node version update from 22 to 24 [@lzandman] [@GCHQDeveloper581] | [#2347] - Fix XSS in Show Base64 offsets [@C85297] | [#2346] - Make compatible with node >=22 [@GCHQDeveloper581] | [#2273] - Fix(node): enable asynchronous operation support in Node.js API [@engin0223] [@GCHQDeveloper581] | [#2342] - Feature: Change to nginx-unprivileged image for better kubernetes support [@hsolberg] | [#1922] Breaking changes: - Minimum supported node version - now v24 (was v16) - Change of exported port on Docker Container - now 8080 (was 80) - Node API now exports "bake" and "execute" functions as async.
Click to expand v10 minor versions