Junglewise Threat Intelligence

CVE-2019-17592: csv-parse regular expression denial of service

CVE-2019-17592 · Severity: low · CVSS 3.1 · Published 2019-10-15

Executive brief

csv-parse is a popular Node.js library used to parse CSV data files. A vulnerability in versions before 4.4.6 allows attackers to send specially crafted CSV data that causes the parser to consume excessive CPU resources and become unresponsive, disrupting any application that uses this library to process untrusted CSV input. This could affect data import services, analytics pipelines, and other systems that accept CSV file uploads.

Technical details

The vulnerability is a regular expression denial of service (ReDoS) in the __isInt() function used by the cast option. The malformed regular expression performs catastrophic backtracking when processing large specially-crafted input strings. An attacker can trigger this condition by providing CSV data with values designed to exploit the regex pattern, causing the parsing process to hang or consume excessive CPU resources. The vulnerability affects all versions prior to 4.4.6. The fix removes the vulnerable regular expression and replaces it with a safer validation approach. Exploitation requires network access to an application that uses csv-parse with the cast option enabled.

Affected products

  • Node.js CSV csv-parse before 4.4.6

Timeline

  • 2019-10-14: disclosed
  • 2019-10-15: patched: Version 4.4.6 released with fix
  • 2019-10-15: advisory: GitHub advisory GHSA-582f-p4pg-xc74 published

References

Related threats