npm package report

Is csv-parse safe?

2 known vulnerabilities, worst severity HIGH.

cvss

7.5

how bad it is if exploited, out of 10

epss

2.3%

chance of exploitation in the next 30 days

xyz score

4.4

CyberXYZ composite, out of 10

fig. 01 — GHSA-582f-p4pg-xc74, the advisory selected below

// advisories

GHSA-582f-p4pg-xc74

HIGHCVE-2019-17592

Versions of csv-parse prior to 4.4.6 are vulnerable to Regular Expression Denial of Service. The isInt() function contains a malformed regular expression that processes large specially-crafted input very slowly, leading to a Denial of Service. This is triggered when using the cast option.

Affected: < 4.4.6
Fixed in: 4.4.6
Weakness: CWE-20
Published: 2019-10-15
Source: github

GHSA NVD MITRE reference reference reference reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 01:35 UTC. The most recent advisory here was published 2026-09-08. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is csv-parse safe? npm package security report | CyberXYZ