# CyberChef v11.3.0

- Product: CyberChef (https://whatsnew.fyi/product/cyberchef)
- Vendor: gchq
- Date: 2026-07-24
- Version: v11.3.0
- Original notes: https://github.com/gchq/CyberChef/releases/tag/v11.3.0
- Permalink: https://whatsnew.fyi/product/cyberchef/releases/v11.3.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix pretty recipe parser ReDoS
- **added** — Add modulo operation
- **added** — Add Generate Prime Number operation
- **added** — Add Modular Inverse operation
- **added** — Add Extended GCD operation
- **added** — Add COBS encoding/decoding operations
- **added** — Add TEA and XTEA block ciphers
- **added** — Add PRESENT and Twofish ciphers
- **added** — Add Ascon (NIST SP 800-232) operations: Hash, MAC, Encrypt, Decrypt
- **added** — Add RenderPDF functionality
- **added** — Add automated parameter validation framework
- **fixed** — Await Node API operations whose run() returns a non-async Promise
- **fixed** — fromDecimal Auto delimiter now correctly parses multiple numbers
- **fixed** — Remove stray punctuation from malformed To HTML Entity table values
- **fixed** — Support constructor and __proto__ parameters in Parse URI
- **fixed** — HOTP and TOTP type errors
- **fixed** — Fix base32 unicode alphabet
- **fixed** — TOTP input validation for correct otpauth uri generation
- **fixed** — Validate Wrap line width
- **fixed** — Handle malformed image parser errors in View Bit Plane

This release includes a security fix ([#2687])
- Security: Fix pretty recipe parser ReDoS [@zainnadeem786] | [#2687]
- feat: add modulo operation [@thomasnemer] [@GCHQDeveloper581] | [#2103]
- Add HMAC regression tests for Decimal key parsing [@alleria173] | [#2680]
- fix: await Node API operations whose run() returns a non-async Promise [@roberson-io] | [#2659]
- chore (deps): bump morgan from 1.10.1 to 1.11.0  | [#2676]
- fix: fromDecimal Auto delimiter now correctly parses multiple numbers [@min23asdw] | [#2270]
- Add Generate Prime Number operation [@p-leriche] | [#2212]
- Add Modular Inverse operation [@p-leriche] | [#2207]
- Consolidate HTML entity tables into a single spec-generated source (#2645) [@roberson-io] | [#2671]
- Add Extended GCD operation [@p-leriche] | [#2206]
- Add COBS encoding/decoding operations [@giesmininkas] | [#2185]
- chore (deps): bump websocket-driver from 0.7.4 to 0.7.5  | [#2673]
- fix: remove stray punctuation from malformed To HTML Entity table values [@roberson-io] | [#2660]
- chore (deps): bump the actions-dependencies group across 1 directory with 6 updates  | [#2668]
- chore (deps): bump the minor-updates group across 1 directory with 3 updates  | [#2669]
- chore (deps): bump the patch-updates group with 5 updates  | [#2654]
- feat: add TEA and XTEA block ciphers [@thomasxm] | [#2225]
- feat: add PRESENT and Twofish ciphers [@thomasxm] | [#2157]
- fix: support constructor and __proto__ parameters in Parse URI (#2578) [@mansiverma897993] | [#2581]
- feat: Implement automated option-type ingredient validation [@mansiverma897993] | [#2625]
- Add Ascon (NIST SP 800-232) operations: Hash, MAC, Encrypt, Decrypt [@thomasxm] | [#2155]
- chore (deps): bump the patch-updates group across 1 directory with 6 updates  | [#2638]
- chore (deps): bump webpack from 5.107.2 to 5.108.3 in the minor-updates group  | [#2635]
- chore (deps): bump nginxinc/nginx-unprivileged from `458ecbe` to `fd3314e` in the docker-dependencies group  | [#2633]
- Feature: automatically expire PRs if CLA remains unsigned for an extended period [@GCHQDeveloper581] | [#2636]
- fix/2445 HOTP (and 2426 TOTP) type errors [@alleria173] | [#2620]
- Fix base32 unicode alphabet [@loki1205] | [#2380]
- Add a workflow to automatically flag PRs without a signed CLA [@GCHQDeveloper581] | [#2627]
- fix/2444 TOTP input validation for correct otpauth uri generation [@alleria173] | [#2621]
- Validate Wrap line width [@vetrovk] [@GCHQDeveloper581] [@C85297] | [#2606]
- Handle malformed image parser errors in View Bit Plane [@zainnadeem786] | [#2612]
- Fixes #2446 hotp otpauth uri validation [@alleria173] | [#2614]
- Handle invalid bcrypt salt errors in Bcrypt compare [@zainnadeem786] | [#2615]
- Validate empty Show On Map options [@vetrovk] | [#2631]
- Create AGENTS.md file [@C85297] | [#2619]
- Set parameter validation Metadata for GenerateImage operations [@GCHQDeveloper581] | [#2611]
- Update 4 vulnerable dependencies [@GCHQDeveloper581] | [#2616]
- Fix BigNumber deserialisation in Dish, and add tests [@GCHQDeveloper581] | [#2607]
- chore (deps): bump the docker-dependencies group with 2 updates  | [#2600]
- chore (deps): bump the patch-updates group with 8 updates  | [#2602]
- chore (deps): bump actions/checkout from 6.0.3 to 7.0.0 in the actions-dependencies group  | [#2601]
- chore (deps): bump the minor-updates group with 2 updates  | [#2603]
- Handle empty Generate Image mode [@vetrovk] | [#2598]
- Fix stale presenter after expected operation errors [@zainnadeem786] [@GCHQDeveloper581] | [#2589]
- Clean up/rationalise webpack paths and thereby increase compatibility for Win… [@GCHQDeveloper581] | [#2585]
- Improve parameter validation for a number of operations where exceptions otherwise caused. [@GCHQDeveloper581] | [#2586]
- Fix uncaught TypeError in "Show on map" operation. [@lzandman] | [#2453]
- fix: jsonata $base64decode/$base64encode in Web Worker [@min23asdw] | [#2275]
- fix Dechunk HTTP Response leaks terminating chunk and trail

_[Truncated at 4000 characters — full notes: https://github.com/gchq/CyberChef/releases/tag/v11.3.0]_