CVE-2019-17592

The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service

published October 14, 2019

CVSS
—
EPSS
2%
Percentile
83.0
In the wild
Unconfirmed
What it is

The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02276 · 83.0th percentile
Published
2019-10-14T19:59Z
EPSS history
Timeline
  • 14 OCT 19:59Z
    The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service
    cvelistv5