TI-2020-16077 Aliases CVE-2020-26256 GHSA-8cv5-p934-3hwp

Denial of service in fast-csv

LOW 32CWE-400Published 2020-12-08 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Fast-csv is an npm package for parsing and formatting CSVs or any other delimited value file in node. In fast-cvs before version 4.3.6 there is a possible ReDoS vulnerability (Regular Expression Denial of Service) when using ignoreEmpty option when parsing. This has been patched in `v4.3.6` You will only be affected by this if you use the `ignoreEmpty` parsing option. If you do use this option it is recommended that you upgrade to the latest version `v4.3.6` This vulnerability was found using a CodeQL query which identified `EMPTY_ROW_REGEXP` regular expression as vulnerable.

Why it matters now

EPSS 0.01537 75th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed fast-csv (C2FO): 4.3.6fast-csv (npm): 4.3.6+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
C2FO	fast-csv	before 4.3.6	4.3.6	Patch available	CNA
—	fast-csv (npm)	before 4.3.6	4.3.6	Patch available	GHSA-8cv5-p934-3hwp
—	@fast-csv/parse (npm)	before 4.3.6	4.3.6	Patch available	GHSA-8cv5-p934-3hwp

fast-csv VendorC2FO Affected before 4.3.6 Fixed in 4.3.6 Patch available CNA
fast-csv (npm) Vendor— Affected before 4.3.6 Fixed in 4.3.6 Patch available GHSA-8cv5-p934-3hwp
@fast-csv/parse (npm) Vendor— Affected before 4.3.6 Fixed in 4.3.6 Patch available GHSA-8cv5-p934-3hwp

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:c2fo:fast-csv::::::node.js::*	before 4.3.6	Vulnerable	C2FO

cpe:2.3:a:c2fo:fast-csv:*:*:*:*:*:node.js:*:* Versions before 4.3.6 Vulnerable ·C2FO

Remediation

Fix · CNA fast-csv (C2FO) Fixed in 4.3.6
Fix · GHSA-8cv5-p934-3hwp fast-csv (npm) Fixed in 4.3.6 Advisory →
Fix · GHSA-8cv5-p934-3hwp @fast-csv/parse (npm) Fixed in 4.3.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-26256
2026-10-03 Alias added: GHSA-8cv5-p934-3hwp

References

Exploit 1

https://lgtm.com/query/8609731774537641779/

Patch 1

https://github.com/C2FO/fast-csv/commit/4bbd39f26a8cd7382151ab4f5fb102234b2f829e

Advisory 4

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences