CVE-2020-26256
Description
Fast-csv is an npm package for parsing and formatting CSVs or any other delimited value file in node. In fast-cvs before version 4.3.6 there is a possible ReDoS vulnerability (Regular Expression Denial of Service) when using ignoreEmpty option when parsing. This has been patched in `v4.3.6` You will only be affected by this if you use the `ignoreEmpty` parsing option. If you do use this option it is recommended that you upgrade to the latest version `v4.3.6` This vulnerability was found using a CodeQL query which identified `EMPTY_ROW_REGEXP` regular expression as vulnerable.
How to fix
- c2fo fast-csv4.3.6 or later
- fast-csv4.3.6 or later
- @fast-csv/parse4.3.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| c2fo fast-csv | v < 4.3.6 | 4.3.6 |
| fast-csvnpm | v < 4.3.6 | 4.3.6 |
| @fast-csv/parsenpm | v < 4.3.6 | 4.3.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.