fast-csv (npm) has 1 known vulnerability, the worst rated LOW. Upgrade to 4.3.6 or later to clear it. No malicious-package signal is recorded.
0 direct dependencies
none carry a known advisory
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
CVSS v3.1 base score out of 10; GitHub rates it LOW
chance of exploitation in 30 days, 75th percentile of all CVEs
CyberXYZ composite out of 10
fig. 01 — GHSA-8cv5-p934-3hwp, the advisory selected below
Possible ReDoS (Regular Expression Denial of Service) when using ignoreEmpty option when parsing.
Full advisory text at GitHub advisory or NVD.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CyberXYZ does not call a package safe in absolute terms. It records 1 known vulnerability for fast-csv (npm), the worst rated LOW, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Yes. CyberXYZ records 1 known vulnerability for fast-csv (npm), the worst rated LOW. They are GHSA-8cv5-p934-3hwp.
4.3.6 or later clears every advisory recorded for fast-csv (npm). Check the release you pick before installing it.
Search fast-csv in CyberXYZ Check at https://cyberxyz.io/check?q=fast-csv. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 06:54 UTC. The most recent advisory here was published 2020-12-08. Updated continuously from NVD, GHSA, OSV and CNA feeds.