The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option.
CVE-2019-17592 - High Severity Vulnerability
CSV parsing implementing the Node.js `stream.Transform` API
Library home page: https://registry.npmjs.org/csv-parse/-/csv-parse-1.3.3.tgz
Path to dependency file: /todoapp/nodejs/package.json
Path to vulnerable library: /todoapp/nodejs/node_modules/csv-parse/package.json,/todoapp/nodejs_api/node_modules/csv-parse/package.json
Dependency Hierarchy: - restify-4.0.3.tgz (Root Library) - csv-0.4.6.tgz - :x: **csv-parse-1.3.3.tgz** (Vulnerable Library)
Found in base branch: master
The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option.
Publish Date: 2019-10-14
URL: CVE-2019-17592
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1171
Release Date: 2019-10-14
Fix Resolution (csv-parse): 4.4.6
Direct dependency fix Resolution (restify): 8.1.0
Step up your Open Source Security Game with Mend here