CVE-2026-85063: node-csv: Prototype replacement still reachable via columns path
node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an attacker-controlled array through obj['proto'], and replaces the parsed record object's prototype. A malicious CSV header can therefore inject inherited array values into the returned record, hide those inherited values from JSON serialization, and affect property enumeration and type or shape checks in applications that process the record. This issue is fixed in version 7.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
node-csvto a version that resolves this vulnerability.Fixed in 7.0.2
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using csv-parse versions before 7.0.2 are exposed when they enable both the columns and group_columns_by_name options and parse attacker-controlled CSV input containing duplicate __proto__ headers.
What must an attacker provide to exploit the behavior?
The attacker needs to supply a malicious CSV header with a duplicate __proto__ column name. The vulnerable parser then assigns an attacker-controlled array through obj['__proto__'] while grouping duplicate column names.
What are the practical effects on parsed records?
The parsed record object's prototype can be replaced, causing inherited array values to appear during property access. Those values may be omitted by JSON serialization and can alter property enumeration, type checks, or object-shape checks performed by the application.
How can this be remediated?
Upgrade csv-parse to version 7.0.2. If an immediate upgrade is not possible, avoid enabling the affected columns and group_columns_by_name option combination for untrusted CSV input.