CVE-2020-26256 Denial of service in fast-csv
Attackers can cause denial of service in fast-csv by exploiting a ReDoS vulnerability when the ignoreEmpty option is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-26256?
CVE-2020-26256 is a medium-severity denial of service vulnerability in C2FO fast-csv, published on 8 Dec 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Fast-csv is an npm package for parsing and formatting CSVs or any other delimited value file in node. In fast-cvs before version 4.3.6 there is a possible ReDoS vulnerability (Regular Expression Denial of Service) when using ignoreEmpty option when parsing. This has been patched in `v4.3.6` You will only be affected by this if you use the `ignoreEmpty` parsing option. If you do use this option it is recommended that you upgrade to the latest version `v4.3.6` This vulnerability was found using a CodeQL query which identified `EMPTY_ROW_REGEXP` regular expression as vulnerable.
Weakness: CWE-400
Which versions are affected by CVE-2020-26256?
4 open source packages ship an affected version, including @fast-csv/parse and fast-csv. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@fast-csv/parse npm | All versions | 4.3.6 |
@fast-csv/parse npm | All versions | 4.3.6 |
fast-csv npm | All versions | 4.3.6 |
fast-csv npm | All versions | 4.3.6 |
Products include C2fo Fast-Csv.
How do I fix CVE-2020-26256?
Upgrade @fast-csv/parse to 4.3.6 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-26256 being exploited?
There is no known exploitation of CVE-2020-26256 in the wild and no public exploit code.
Sources
Also known as GHSA-8cv5-p934-3hwp.