CVE-2020-26256

MEDIUM

fast-csv < 4.3.6 - Regular Expression Denial of Service via ignoreEmpty Parsing Option

Title source: llm
STIX 2.1

Description

Fast-csv is an npm package for parsing and formatting CSVs or any other delimited value file in node. In fast-cvs before version 4.3.6 there is a possible ReDoS vulnerability (Regular Expression Denial of Service) when using ignoreEmpty option when parsing. This has been patched in `v4.3.6` You will only be affected by this if you use the `ignoreEmpty` parsing option. If you do use this option it is recommended that you upgrade to the latest version `v4.3.6` This vulnerability was found using a CodeQL query which identified `EMPTY_ROW_REGEXP` regular expression as vulnerable.

References (6)

Core 6
Core References
Exploit, Third Party Advisory x_refsource_misc
https://lgtm.com/query/8609731774537641779/
Third Party Advisory x_refsource_misc
https://github.com/C2FO/fast-csv/issues/540
Various Sources x_refsource_misc
https://www.npmjs.com/package/%40fast-csv/parse
Product, Third Party Advisory x_refsource_misc
https://www.npmjs.com/package/fast-csv

Scores

CVSS v3 5.7
EPSS 0.0153
EPSS Percentile 71.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Details

CWE
CWE-400
Status published
Products (3)
c2fo/fast-csv < 4.3.6
fast-csv/parse 0 - 4.3.6npm
npm/fast-csv 0 - 4.3.6npm
Published Dec 08, 2020
Tracked Since Feb 18, 2026