CVE-2026-85063: node-csv Prototype Replacement Vulnerability in csv-parse Package
Summary
CVE-2026-85063: node-csv: Prototype replacement still reachable via columns path. Affects csv-parse versions < 7.0.2. Fixed in 7.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The csv-parse package is a widely used library in the Node.js ecosystem for parsing CSV (Comma-Separated Values) data. It provides features such as customizable parsing options, including the ability to handle headers and group columns by name. However, due to its flexibility, it can also be susceptible to certain vulnerabilities if not properly configured.
Vulnerability Detail
The vulnerability arises when both the 'columns' and 'group_columns_by_name' options are enabled, and a duplicated 'proto' header is present. This leads to a situation where the duplicate-column branch assigns an array to obj['proto'], invoking the proto setter. As a result, the prototype of the parsed record object is replaced with attacker-controlled data, potentially allowing for arbitrary code execution or data manipulation.
How To Fix
Latest published version: 7.0.3 as of 23 Oct 2026
npm install csv-parse@7.0.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.2
This is the first release that contains the fix.
npm install csv-parse@7.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, you can disable the usage of both the 'columns' and 'group_columns_by_name' options in your csv-parse configuration. This will mitigate the risk associated with this vulnerability.
Conclusion
The CVE-2026-85063 vulnerability in the csv-parse package poses a significant risk if certain options are enabled. It is crucial for developers to update to the patched version or implement workarounds to protect their applications from potential exploitation.
See every vulnerability recorded for csv-parse →
FAQ
CVE-2026-85063 is a vulnerability in the csv-parse package that allows an attacker to manipulate the prototype of parsed objects, potentially leading to security issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow an attacker to execute arbitrary code or manipulate data within your application, leading to severe security breaches.
Yes, the vulnerability has been patched in version 7.0.2 of the csv-parse package. It is recommended to update to this version or later.
If you cannot update the package, you should disable the 'columns' and 'group_columns_by_name' options in your configuration to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for csv-parse.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
