GitHub Advisoryadvisory · npm

GHSA-8cv5-p934-3hwp Denial of service in fast-csv

LOW Published 2020-12-08 Modified 2021-10-08 Official page ↗
Aliases
CVE-2020-26256
Ecosystem
npm
Packages
fast-csv, @fast-csv/parse
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2020-12-08

Affected packages

• npm fast-csv: < 4.3.6 → fixed in 4.3.6 • npm @fast-csv/parse: < 4.3.6 → fixed in 4.3.6

Description

Impact Possible ReDoS (Regular Expression Denial of Service) when using `ignoreEmpty` option when parsing. Patches This has been patched in `v4.3.6` Workarounds You will only be affected by this if you use the `ignoreEmpty` parsing option. If you do use this option it is recommended that you upgrade to the latest version `v4.3.6` References This vulnerability was found using a CodeQL query which identified `EMPTY_ROW_REGEXP` regular expression as vulnerable. Link to query run. For more information If you have any questions or comments about this advisory: • Open an issue in fast-csv

Related

Alias · CVE (1)

  • CVE-2020-26256 Fast-csv is an npm package for parsing and formatting CSVs or any other delimited value file in node. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References