Impact With columns: true and groupcolumnsbyname: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj['proto'], invoking the proto setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 (Object.hasOwn duplicate check + Object.defineProperty assignment).

Patches The problem been patched.

Workarounds Disable usage of both the columns and groupcolumnsbyname options.

References issue #496, PR #497

The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The isInt() function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option.