CVE-2026-85063

Summary

node-csv: Prototype replacement still reachable via columns path

Severity

medium

EPSS

0.3% (p25)

CWE

CWE-1321

Also known as

GHSA-8cw4-87c7-c6xx

Published

2026-09-08

Updated

2026-09-08

Advisory details

Impact

With columns: true and group_columns_by_name: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj['proto'], invoking the proto setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 (Object.hasOwn duplicate check + Object.defineProperty assignment).

Patches

The problem been patched.

Workarounds

Disable usage of both the columns and group_columns_by_name options.

References

issue #496, PR #497

References

• https://github.com/advisories/GHSA-8cw4-87c7-c6xx
• https://github.com/adaltas/node-csv/security/advisories/GHSA-8cw4-87c7-c6xx
• https://nvd.nist.gov/vuln/detail/CVE-2026-85063
• https://github.com/adaltas/node-csv/issues/496
• https://github.com/adaltas/node-csv/pull/497
• https://github.com/adaltas/node-csv/commit/eb4d1484589c976dcb977db8dd0b90e015a6f66e

Related advisories

• CVE-2026-53609 — critical · npm/apostrophe
• CVE-2026-49252 — critical · npm/@deepstream/server
• CVE-2026-48713 — critical · npm/i18next-fs-backend
• CVE-2026-48714 — critical · npm/i18next-http-middleware
• CVE-2019-10744 — critical · npm/lodash
• CVE-2026-63376 — high · npm/toml
• CVE-2026-82404 — high · npm/@toon-format/toon
• CVE-2026-71553 — high · npm/apostrophe

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity