GHSA-582f-p4pg-xc74HighCVSS 7.5

Regular Expression Denial of Service in csv-parse

Published
October 15, 2019
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2019-17592 →

📋 Description

Versions of csv-parse prior to 4.4.6 are vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malformed regular expression that processes large specially-crafted input very slowly, leading to a Denial of Service. This is triggered when using the cast option.

Recommendation

Upgrade to version 4.4.6 or later.

🎯 Affected products1

  • npm/csv-parse:< 4.4.6

🔗 References (6)