GitHub Advisoryadvisory · npm

GHSA-582f-p4pg-xc74 Regular Expression Denial of Service in csv-parse

HIGH Published 2019-10-15 Modified 2022-01-04 Official page ↗
Aliases
CVE-2019-17592
Ecosystem
npm
Packages
csv-parse
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20, CWE-400
Reviewed
2019-10-15

Affected packages

• npm csv-parse: < 4.4.6 → fixed in 4.4.6

Description

Versions of `csv-parse` prior to 4.4.6 are vulnerable to Regular Expression Denial of Service. The `__isInt()` function contains a malformed regular expression that processes large specially-crafted input very slowly, leading to a Denial of Service. This is triggered when using the `cast` option. Recommendation Upgrade to version 4.4.6 or later.

Related

Alias · CVE (1)

  • CVE-2019-17592 The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References