Prototype Pollution

Overview org.webjars.npm:csv-parse is a parser converting CSV text input into arrays or objects. Affected versions of this package are vulnerable to Prototype Pollution in its duplicate-column handling, which assigns an array to obj'proto' when a header contains duplicate proto entries, triggerin...

@accounter/client (>=0.0.12-alpha-20260616111400-042980593a256ba48203b66c0e7e022e45b91fbd, <=0.1.0-alpha-20260806092250-bc394b1d7590fd72a701aba3bdd0e263201e18ab), @blinkk/root-cms (>=3.4.1, <=3.5.1) +36 more potentially affected by CVE-2026-85063 via csv-parse (>=7.0.0, <=7.0.1)

csv-parse NPM version =7.0.0, =0.0.12-alpha-20260616111400-042980593a256ba48203b66c0e7e022e45b91fbd, =3.4.1, =0.1.4, =0.1.0, =0.1.0, =0.1.0, =0.53.29, =20260617.1750.25, =20260617.1750.26, =0.15.2, =0.13.1, =0.13.1, =0.11.1, =0.11.3 and more Source cves: CVE-2026-85063 Source advisory:...

DEBIAN-CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

UBUNTU-CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063

A flaw was found in node-csv, specifically within its csv-parse component. When configured with columns and groupcolumnsbyname options, a remote attacker can craft a malicious CSV header to manipulate the proto property. This allows the injection of attacker-controlled values into the parsed...

CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063

node-csv (csv-parse) versions prior to 7.0.2 are vulnerable to a prototype replacement issue when the columns and group_columns_by_name options are enabled. In packages/csv-parse/lib/api/index.js, a duplicate __proto__ header in a CSV file is treated as an existing property, allowing an attacker-...

CVE-2026-85063: Improperly Controlled Modification of Object Prototype Attributes

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

PT-2026-85253

Name of the Vulnerable Software and Affected Versions node-csv versions prior to 7.0.2 Description When the columns and group columns by name options are enabled, the csv-parse component treats a duplicate proto header as an existing property in the packages/csv-parse/lib/api/index.js file. This...

CVE-2026-84394 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

PT-2026-84880

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.6 fast-uri versions prior to 3.1.7 fast-uri versions prior to 4.1.4 Description The parse function fails to report an error when a host contains an unbalanced or misplaced authority bracket. A host starting with ...

CVE-2026-83611

xmldom (and @xmldom/xmldom ) is a pure JavaScript XML DOM parser. The vulnerability lies in DOMParser.parseFromString() , which can silently accept a malformed end tag where the tag name is followed by a line break and trailing content (e.g., ), closing the element and discarding the trailing con...

CVE-2026-83611 xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString can silently accept an end tag such as , close the element, and discard th...

CVE-2026-83611: Improper Validation of Syntactic Correctness of Input

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString can silently accept an end tag such as , close the element, and discard th...

Linux Distros Unpatched Vulnerability : CVE-2026-80603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfconntrackirc: fix parsedcc off-by-one OOB read parsedcc treats dataend as an inclusive end pointer, but its only caller passes datalimit = ibptr +...