16 matches found
EUVD-2026-70737
node-csv: Prototype replacement still reachable via columns path...
node-csv: Prototype replacement still reachable via columns path
Impact With columns: true and groupcolumnsbyname: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj'proto', invoking the proto setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 Object.hasOwn duplicate...
Security Bulletin: IBM Documentation Offline is vulnerable to `Denial of Service via __proto__ header name in req.headersDistinct` due to Node.js (CVE-2026-21710)
Summary IBM Documentation Offline utilizes Node.js as a third-party component, which contains a vulnerability that could potentially affect your product's stability and security. CVE-2026-21710 CVSS: 3.1 is a denial-of-service DoS vulnerability identified in the Node.js core HTTP module. An...
Linux Distros Unpatched Vulnerability : CVE-2026-85063
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbynam...
CVE-2026-85063
node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...
UBUNTU-CVE-2026-85063
node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...
CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path
node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...
CVE-2026-85063
node-csv (csv-parse) versions prior to 7.0.2 are vulnerable to a prototype replacement issue when the columns and group_columns_by_name options are enabled. In packages/csv-parse/lib/api/index.js, a duplicate __proto__ header in a CSV file is treated as an existing property, allowing an attacker-...
CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path
node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...
CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path
node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...
Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header
A flaw was found in Node.js. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request that includes a header named proto. When a Node.js application processes this request and attempts to access distinct headers, it encounters an unhandled error, leading to an...
Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header
A flaw was found in Node.js. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request that includes a header named proto. When a Node.js application processes this request and attempts to access distinct headers, it encounters an unhandled error, leading to an...
Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header
A flaw was found in Node.js. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request that includes a header named proto. When a Node.js application processes this request and attempts to access distinct headers, it encounters an unhandled error, leading to an...
CVE-2026-34752: Uncaught Exception
Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with proto: as a header name crashes the Haraka worker process. This issue has been patched in version 3.1.4...
