CVE-2019-17592: Regular Expression Denial of Service in csv-parse
Summary
CVE-2019-17592: Regular Expression Denial of Service in csv-parse. Affects csv-parse versions < 4.4.6. Fixed in 4.4.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The csv-parse package is an npm package used for parsing CSV data. It provides a way to convert CSV data into JavaScript objects or arrays. The package is widely used in various applications that handle CSV files. However, versions prior to 4.4.6 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack.
Vulnerability Detail
The vulnerability in csv-parse is due to a malformed regular expression in the __isInt() function. This regular expression processes large specially-crafted input very slowly, leading to a Denial of Service (DoS) when the cast option is used. An attacker can exploit this vulnerability by providing a specially-crafted input that triggers the slow processing of the regular expression, causing the application to become unresponsive or crash. The impact of this vulnerability can be severe, as it allows an attacker to disrupt the availability of the affected application.
How To Fix
Latest published version: 7.0.3 as of 23 Oct 2026
npm install csv-parse@7.0.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.4.6
This is the first release that contains the fix.
npm install csv-parse@4.4.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to the fixed version of the csv-parse package to mitigate the risk.
Conclusion
The csv-parse package prior to version 4.4.6 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. To mitigate this vulnerability, it is crucial to upgrade to version 4.4.6 or later. This will ensure that the malformed regular expression is fixed, preventing potential DoS attacks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for csv-parse →
FAQ
This vulnerability allows an attacker to perform a Denial of Service (DoS) attack by providing specially-crafted input that triggers slow processing of a regular expression. This can lead to the unresponsiveness or crashing of the affected application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
Yes, upgrading to version 4.4.6 or later of the csv-parse package fixes this vulnerability. It is recommended to update to the latest version to ensure the security of your application.
No, there are no known workarounds for this vulnerability. Upgrading to the fixed version is the only solution.
You can find more information about this vulnerability in the GitHub Security Advisory database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/10/GHSA-582f-p4pg-xc74/GHSA-582f-p4pg-xc74.json
Related vulnerabilities
Recent vulnerabilities recorded for csv-parse.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
