~ / search / GHSA-582f-p4pg-xc74

GHSA-582f-p4pg-xc74

Regular Expression Denial of Service in csv-parse

Source: GitHub Advisory Database (reviewed) High CVE-2019-17592

Packages

EcosystemPackageAffectedFixed in
npm csv-parse < 4.4.6 4.4.6

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `csv-parse` prior to 4.4.6 are vulnerable to Regular Expression Denial of Service. The `__isInt()` function contains a malformed regular expression that processes large specially-crafted input very slowly, leading to a Denial of Service. This is triggered when using the `cast` option. ## Recommendation Upgrade to version 4.4.6 or later.

References

External links from the advisory. They lead to third-party sites.