Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Vulnerability: csv-parse - Regular Expression Denial of Service

See original GitHub issue

                       === npm audit security report ===

# Run  npm install csv-parse@4.4.6  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ csv-parse                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ csv-parse                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ csv-parse                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1171                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


found 1 high severity vulnerability in 9460 scanned packages
  1 vulnerability requires semver-major dependency updates.

Issue Analytics

State:
Created 4 years ago
Reactions:24
Comments:8 (2 by maintainers)

Top GitHub Comments

4reactions

acrosmancommented, Oct 31, 2019

Fixed by #930

0reactions

buptliuhscommented, Feb 9, 2020

Fixed in 1.9.3

Top Results From Across the Web

Regular Expression Denial of Service (ReDoS) in csv-parse

csv-parse is a parser converting CSV text input into arrays or objects. Affected versions of this package are vulnerable to Regular Expression ...

Regular Expression Denial of Service in csv-parse - GitHub

Versions of csv-parse prior to 4.4.6 are vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malformed ...

Regular Expression Denial Of Service (ReDoS) Vulnerability in the ...

fast-csv is vulnerable to regular expression denial of service (ReDoS). The vulnerability exists through the usage of the `ignoreEmpty` option when parsing. Tag ......

Vulnerability Details : CVE-2019-17592

CVE-2019-17592 : The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service.

Regular Expression Denial Of Service (ReDoS) - Vulners

fast-csv is vulnerable to regular expression denial of service (ReDoS). The vulnerability exists through the usage of the ignoreEmpty option when...