CVE-2020-26256

Fast-csv is an npm package for parsing and formatting CSVs or any other delimited value file in node. In fast-cvs before version 4.3.6 there is a possible ReDoS vulnerability (Regular Expression Denial of Service) when using ignoreEmpty option when parsing. This has been patched in `v4.3.6` You will only be affected by this if you use the `ignoreEmpty` parsing option. If you do use this option it is recommended that you upgrade to the latest version `v4.3.6` This vulnerability was found using a CodeQL query which identified `EMPTY_ROW_REGEXP` regular expression as vulnerable.

• CWE-400
• CWE-400

• https://github.com/C2FO/fast-csv/commit/4bbd39f26a8cd7382151ab4f5fb102234b2f829ePatch, Third Party Advisory
• https://github.com/C2FO/fast-csv/issues/540Third Party Advisory
• https://github.com/C2FO/fast-csv/security/advisories/GHSA-8cv5-p934-3hwpThird Party Advisory
• https://lgtm.com/query/8609731774537641779/Exploit, Third Party Advisory
• https://www.npmjs.com/package/%40fast-csv/parse
• https://www.npmjs.com/package/fast-csvProduct, Third Party Advisory
• https://github.com/C2FO/fast-csv/commit/4bbd39f26a8cd7382151ab4f5fb102234b2f829ePatch, Third Party Advisory
• https://github.com/C2FO/fast-csv/issues/540Third Party Advisory
• https://github.com/C2FO/fast-csv/security/advisories/GHSA-8cv5-p934-3hwpThird Party Advisory
• https://lgtm.com/query/8609731774537641779/Exploit, Third Party Advisory
• https://www.npmjs.com/package/%40fast-csv/parse
• https://www.npmjs.com/package/fast-csvProduct, Third Party Advisory

Published

Dec 8, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26250OAuthenticator is an OAuth login mechanism for JupyterHub. I…6.3
• CVE-2020-26251Open Zaak is a modern, open-source data- and services-layer …4.7
• CVE-2020-26252OpenMage is a community-driven alternative to Magento CE. In…7.2
• CVE-2020-26253Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3…5.9
• CVE-2020-26254omniauth-apple is the OmniAuth strategy for "Sign In with Ap…7.7
• CVE-2020-26255Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3…9.1
• CVE-2020-26257Matrix is an ecosystem for open federated Instant Messaging …6.5
• CVE-2020-26258XStream is a Java library to serialize objects to XML and ba…7.7
• CVE-2020-26259XStream is a Java library to serialize objects to XML and ba…6.8
• CVE-2020-2626Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26260BookStack is a platform for storing and organising informati…6.4
• CVE-2020-26261jupyterhub-systemdspawner enables JupyterHub to spawn single…7.9