npm csv-parse vulnerabilities

Latest npm csv-parse CVEs

Newest publication first

1. CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path

   Published 2026-09-03

   Medium·CVSS 6.9

   node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, ass...

2. CVE-2019-17592 Regular Expression Denial of Service in csv-parse

   Published 2019-10-14

   High·CVSS 7.5 EPSS 2.3%

   The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.