{"id":"CVE-2026-85063","summary":"node-csv: Prototype replacement still reachable via columns path","details":"node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name options enabled treats a duplicate __proto__ header as an existing property in packages/csv-parse/lib/api/index.js, assigns an attacker-controlled array through obj['__proto__'], and replaces the parsed record object's prototype. A malicious CSV header can therefore inject inherited array values into the returned record, hide those inherited values from JSON serialization, and affect property enumeration and type or shape checks in applications that process the record. This issue is fixed in version 7.0.2.","aliases":["GHSA-8cw4-87c7-c6xx"],"modified":"2026-09-06T03:30:47.804082083Z","published":"2026-09-03T20:32:46.145Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1321"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85063.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85063.json"},{"type":"ADVISORY","url":"https://github.com/adaltas/node-csv/security/advisories/GHSA-8cw4-87c7-c6xx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85063"},{"type":"REPORT","url":"https://github.com/adaltas/node-csv/issues/496"},{"type":"FIX","url":"https://github.com/adaltas/node-csv/commit/eb4d1484589c976dcb977db8dd0b90e015a6f66e"},{"type":"FIX","url":"https://github.com/adaltas/node-csv/pull/497"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/adaltas/node-csv","events":[{"introduced":"0"},{"fixed":"eb4d1484589c976dcb977db8dd0b90e015a6f66e"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"7.0.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["stream-transform@3.5.1","csv@6.6.1","csv-stringify@6.8.1","csv-parse@7.0.1","csv-issues-esm@0.6.1","csv-issues-cjs@0.4.1","csv-generate@4.6.1","csv-demo-webpack@0.3.1","csv-demo-webpack-ts@0.3.1","csv-demo-ts-esm-node16@0.2.25","csv-demo-ts-cjs-node16@0.2.25","csv-demo-esm@0.0.39","csv-demo-cjs@0.4.1","csv-demo-browser@0.3.1","stream-transform@3.5.0","csv@6.6.0","csv-stringify@6.8.0","csv-parse@7.0.0","csv-issues-esm@0.6.0","csv-issues-cjs@0.4.0","csv-generate@4.6.0","csv-demo-webpack@0.3.0","csv-demo-webpack-ts@0.3.0","csv-demo-ts-esm-node16@0.2.24","csv-demo-ts-cjs-node16@0.2.24","csv-demo-esm@0.0.38","csv-demo-cjs@0.4.0","csv-demo-browser@0.3.0","csv@6.5.1","csv-parse@6.2.1","csv-issues-esm@0.5.3","csv-issues-cjs@0.3.3","csv-demo-webpack@0.2.3","csv-demo-webpack-ts@0.2.3","csv-demo-ts-module-node16@0.2.23","csv-demo-ts-cjs-node16@0.2.23","csv-demo-esm@0.0.37","csv-demo-cjs@0.3.3","csv-demo-browser@0.2.3","stream-transform@3.4.1","csv@6.5.0","csv-stringify@6.7.0","csv-parse@6.2.0","csv-issues-esm@0.5.2","csv-issues-cjs@0.3.2","csv-generate@4.5.1","csv-demo-webpack@0.2.2","csv-demo-webpack-ts@0.2.2","csv-demo-ts-module-node16@0.2.22","csv-demo-ts-cjs-node16@0.2.22","csv-demo-esm@0.0.36","csv-demo-cjs@0.3.2","csv-demo-browser@0.2.2","csv@6.4.1","csv-parse@6.1.0","csv-issues-esm@0.5.1","csv-issues-cjs@0.3.1","csv-demo-webpack@0.2.1","csv-demo-webpack-ts@0.2.1","csv-demo-ts-module-node16@0.2.21","csv-demo-ts-cjs-node16@0.2.21","csv-demo-esm@0.0.35","csv-demo-cjs@0.3.1","csv-demo-browser@0.2.1","stream-transform@3.4.0","stream-transform@3.3.3","csv@6.3.11","csv-stringify@6.5.2","csv-parse@5.6.0","csv-issues-esm@0.4.0","csv-issues-cjs@0.2.8","csv-generate@4.4.2","csv-demo-webpack@0.1.23","csv-demo-webpack-ts@0.1.21","csv-demo-ts-module-node16@0.2.19","csv-demo-ts-cjs-node16@0.2.19","csv-demo-esm@0.0.33","csv-demo-eslint@0.1.23","csv-demo-cjs@0.2.19","csv-demo-browser@0.1.21","csv@6.3.10","csv-stringify@6.5.1","csv-issues-esm@0.3.1","csv-issues-cjs@0.2.7","csv-demo-webpack@0.1.22","csv-demo-webpack-ts@0.1.20","csv-demo-ts-module-node16@0.2.18","csv-demo-ts-cjs-node16@0.2.18","csv-demo-esm@0.0.32","csv-demo-eslint@0.1.22","csv-demo-cjs@0.2.18","csv-demo-browser@0.1.20","stream-transform@3.3.2","csv@6.3.9","csv-stringify@6.5.0","csv-parse@5.5.6","csv-issues-esm@0.3.0","csv-issues-cjs@0.2.6","csv-generate@4.4.1","csv-demo-webpack@0.1.21","csv-demo-webpack-ts@0.1.19","csv-demo-ts-module-node16@0.2.17","csv-demo-ts-cjs-node16@0.2.17","csv-demo-esm@0.0.31","csv-demo-eslint@0.1.21","csv-demo-cjs@0.2.17","csv-demo-browser@0.1.19","csv@6.3.8","csv-parse@5.5.5","csv-issues-esm@0.2.1","csv-issues-cjs@0.2.5","csv-demo-webpack@0.1.20","csv-demo-webpack-ts@0.1.18","csv-demo-ts-module-node16@0.2.16","csv-demo-ts-cjs-node16@0.2.16","csv-demo-esm@0.0.30","csv-demo-cjs@0.2.16","csv-demo-browser@0.1.18","stream-transform@3.3.1","csv@6.3.7","csv-stringify@6.4.6","csv-parse@5.5.4","csv-issues-esm@0.2.0","csv-issues-cjs@0.2.4","csv-generate@4.4.0","csv-demo-webpack@0.1.19","csv-demo-webpack-ts@0.1.17","csv-demo-ts-module-node16@0.2.15","csv-demo-ts-cjs-node16@0.2.15","csv-demo-esm@0.0.29","csv-demo-eslint@0.1.20","csv-demo-cjs@0.2.15","csv-demo-browser@0.1.17","stream-transform@3.3.0","csv@6.3.6","csv-stringify@6.4.5","csv-parse@5.5.3","csv-issues-esm@0.1.0","csv-issues-cjs@0.2.3","csv-generate@4.3.1","csv-demo-webpack@0.1.18","csv-demo-webpack-ts@0.1.16","csv-demo-ts-module-node16@0.2.14","csv-demo-ts-cjs-node16@0.2.14","csv-demo-esm@0.0.28","csv-demo-eslint@0.1.19","csv-demo-cjs@0.2.14","csv-demo-browser@0.1.16","stream-transform@3.2.10","csv@6.3.5","csv-stringify@6.4.4","csv-parse@5.5.2","csv-issues-esm@0.0.18","csv-issues-cjs@0.2.2","csv-demo-webpack@0.1.17","csv-demo-webpack-ts@0.1.15","csv-demo-ts-module-node16@0.2.13","csv-demo-ts-cjs-node16@0.2.13","csv-demo-esm@0.0.27","csv-demo-eslint@0.1.18","csv-demo-cjs@0.2.13","csv-demo-browser@0.1.15","stream-transform@3.2.9","csv@6.3.4","csv-stringify@6.4.3","csv-parse@5.5.1","csv-issues-esm@0.0.17","csv-issues-cjs@0.2.1","csv-generate@4.3.0","csv-demo-webpack@0.1.16","csv-demo-webpack-ts@0.1.14","csv-demo-ts-module-node16@0.2.12","csv-demo-ts-cjs-node16@0.2.12","csv-demo-esm@0.0.26","csv-demo-eslint@0.1.17","csv-demo-cjs@0.2.12","csv-demo-browser@0.1.14","stream-transform@3.2.8","csv@6.3.3","csv-stringify@6.4.2","csv-parse@5.5.0","csv-issues-esm@0.0.16","csv-issues-cjs@0.2.0","csv-generate@4.2.8","csv-demo-webpack@0.1.15","csv-demo-webpack-ts@0.1.13","csv-demo-ts-module-node16@0.2.11","csv-demo-ts-cjs-node16@0.2.11","csv-demo-esm@0.0.25","csv-demo-eslint@0.1.16","csv-demo-cjs@0.2.11","csv-demo-browser@0.1.13","stream-transform@3.2.7","csv@6.3.2","csv-stringify@6.4.1","csv-parse@5.4.1","csv-issues-esm@0.0.15","csv-issues-cjs@0.1.11","csv-generate@4.2.7","csv-demo-webpack@0.1.14","csv-demo-webpack-ts@0.1.12","csv-demo-ts-moduleresolution-node16-cjs@0.2.10","csv-demo-ts-module-node16@0.2.10","csv-demo-esm@0.0.24","csv-demo-eslint@0.1.15","csv-demo-cjs@0.2.10","csv-demo-browser@0.1.12","csv@6.3.1","csv-parse@5.4.0","csv-issues-esm@0.0.14","csv-issues-cjs@0.1.10","csv-demo-webpack@0.1.13","csv-demo-webpack-ts@0.1.11","csv-demo-ts-moduleresolution-node16-cjs@0.2.9","csv-demo-ts-module-node16@0.2.9","csv-demo-esm@0.0.23","csv-demo-cjs@0.2.9","csv-demo-browser@0.1.11","csv@6.3.0","csv-stringify@6.4.0","csv-issues-esm@0.0.13","csv-issues-cjs@0.1.9","csv-demo-webpack@0.1.12","csv-demo-webpack-ts@0.1.10","csv-demo-ts-moduleresolution-node16-cjs@0.2.8","csv-demo-ts-module-node16@0.2.8","csv-demo-esm@0.0.22","csv-demo-eslint@0.1.14","csv-demo-cjs@0.2.8","csv-demo-browser@0.1.10","stream-transform@3.2.6","csv@6.2.12","csv-stringify@6.3.4","csv-parse@5.3.10","csv-issues-esm@0.0.12","csv-issues-cjs@0.1.8","csv-generate@4.2.6","csv-demo-webpack@0.1.11","csv-demo-webpack-ts@0.1.9","csv-demo-ts-moduleresolution-node16-cjs@0.2.7","csv-demo-ts-module-node16@0.2.7","csv-demo-esm@0.0.21","csv-demo-eslint@0.1.13","csv-demo-cjs@0.2.7","csv-demo-browser@0.1.9","stream-transform@3.2.5","csv@6.2.11","csv-stringify@6.3.3","csv-parse@5.3.9","csv-issues-esm@0.0.11","csv-issues-cjs@0.1.7","csv-generate@4.2.5","csv-demo-webpack@0.1.10","csv-demo-webpack-ts@0.1.8","csv-demo-ts-moduleresolution-node16-cjs@0.2.6","csv-demo-ts-module-node16@0.2.6","csv-demo-esm@0.0.20","csv-demo-eslint@0.1.12","csv-demo-cjs@0.2.6","csv-demo-browser@0.1.8","stream-transform@3.2.4","csv@6.2.10","csv-stringify@6.3.2","csv-parse@5.3.8","csv-issues-esm@0.0.10","csv-issues-cjs@0.1.6","csv-generate@4.2.4","csv-demo-webpack@0.1.9","csv-demo-webpack-ts@0.1.7","csv-demo-ts-moduleresolution-node16-cjs@0.2.5","csv-demo-ts-module-node16@0.2.5","csv-demo-esm@0.0.19","csv-demo-eslint@0.1.11","csv-demo-cjs@0.2.5","csv-demo-browser@0.1.7","csv@6.2.8","csv-stringify@6.3.0","csv-parse@5.3.6","csv-issues-esm@0.0.8","csv-issues-cjs@0.1.4","csv-demo-webpack@0.1.7","csv-demo-webpack-ts@0.1.5","csv-demo-ts-moduleresolution-node16-cjs@0.2.3","csv-demo-ts-module-node16@0.2.3","csv-demo-esm@0.0.17","csv-demo-eslint@0.1.9","csv-demo-cjs@0.2.3","csv-demo-browser@0.1.5","stream-transform@3.2.2","csv@6.2.7","csv-stringify@6.2.4","csv-parse@5.3.5","csv-issues-esm@0.0.7","csv-issues-cjs@0.1.3","csv-generate@4.2.2","csv-demo-webpack@0.1.6","csv-demo-webpack-ts@0.1.4","csv-demo-ts-moduleresolution-node16-cjs@0.2.2","csv-demo-ts-module-node16@0.2.2","csv-demo-esm@0.0.16","csv-demo-eslint@0.1.8","csv-demo-cjs@0.2.2","csv-demo-browser@0.1.4","csv@6.2.6","csv-parse@5.3.4","csv-issues-esm@0.0.6","csv-demo-esm@0.0.15","csv@6.2.5","csv-stringify@6.2.3","csv-demo-esm@0.0.14","csv-demo-eslint@0.1.7","csv@6.2.4","csv-parse@5.3.3","csv-demo-esm@0.0.13","csv@6.2.3","csv-stringify@6.2.2","csv-demo-esm@0.0.12","csv-demo-eslint@0.1.6","stream-transform@3.2.1","csv@6.2.2","csv-stringify@6.2.1","csv-parse@5.3.2","csv-issues-esm@0.0.5","csv-issues-cjs@0.1.2","csv-generate@4.2.1","csv-demo-webpack@0.1.5","csv-demo-webpack-ts@0.1.3","csv-demo-ts-module-node16@0.2.1","csv-demo-esm@0.0.11","csv-demo-eslint@0.1.5","csv-demo-cjs@0.2.1","csv-demo-browser@0.1.3","csv@6.2.1","csv-parse@5.3.1","csv-issues-esm@0.0.4","csv-demo-ts-module-node16@0.2.0","csv-demo-esm@0.0.10","stream-transform@3.2.0","csv@6.2.0","csv-ts-demo-node16@0.1.0","csv-stringify@6.2.0","csv-parse@5.3.0","csv-issues-cjs@0.1.1","csv-generate@4.2.0","csv-demo-webpack@0.1.4","csv-demo-webpack-ts@0.1.2","csv-demo-esm@0.0.9","csv-demo-eslint@0.1.4","csv-demo-cjs@0.2.0","csv@6.1.5","csv-parse@5.2.2","csv-demo-esm@0.0.8","csv@6.1.4","csv-parse@5.2.1","csv-issues-esm@0.0.3","csv-demo-esm@0.0.7","csv@6.1.3","csv-stringify@6.1.3","csv-demo-esm@0.0.6","csv-demo-eslint@0.1.3","csv@6.1.2","csv-stringify@6.1.2","csv-demo-esm@0.0.5","csv-demo-eslint@0.1.2","csv@6.1.1","csv-stringify@6.1.1","csv-parse@5.2.0","csv-demo-esm@0.0.4","csv-demo-eslint@0.1.1","stream-transform@3.1.0","csv@6.1.0","csv-stringify@6.1.0","csv-parse@5.1.0","csv-issues-esm@0.0.2","csv-issues-cjs@0.1.0","csv-generate@4.1.0","csv-demo-webpack@0.1.3","csv-demo-webpack-ts@0.1.1","csv-demo-esm@0.0.3","csv-demo-eslint@0.1.0","csv-demo-cjs@0.1.2","csv-demo-browser@0.1.2","stream-transform@3.0.4","csv@6.0.5","csv-stringify@6.0.5","csv-parse@5.0.4","csv-generate@4.0.4","csv-demo-webpack@0.1.2","csv-demo-webpack-ts@0.1.0","csv-demo-esm@0.0.2","csv-demo-cjs@0.1.1","csv-demo-browser@0.1.1","csv@6.0.4","csv-stringify@6.0.4","csv-issues-cjs@0.0.2","csv-demo-webpack@0.1.1","stream-transform@3.0.3","csv@6.0.3","csv-stringify@6.0.3","csv-parse@5.0.3","csv-issues-esm@0.0.1","csv-issues-cjs@0.0.1","csv-generate@4.0.3","csv-demo-webpack@0.1.0","csv-demo-esm@0.0.1","csv-demo-cjs@0.1.0","csv-demo-browser@0.1.0","stream-transform@3.0.2","csv@6.0.2","csv-stringify@6.0.2","csv-parse@5.0.2","csv-generate@4.0.2","stream-transform@3.0.1","csv@6.0.1","csv-stringify@6.0.1","csv-parse@5.0.1","csv-generate@4.0.1","stream-transform@3.0.0","csv@6.0.0","csv-stringify@6.0.0","csv-parse@5.0.0","csv-generate@4.0.0","stream-transform@2.1.3","csv@5.5.3","csv-stringify@5.6.5","csv-parse@4.16.3","csv-generate@3.4.3","stream-transform@2.1.2","csv@5.5.2","csv-stringify@5.6.4","csv-parse@4.16.2","csv-generate@3.4.2","stream-transform@2.1.1","csv@5.5.1","csv-stringify@5.6.3","csv-parse@4.16.1","csv-generate@3.4.1","csv@5.50","csv@5.4.0","v5.3.2","v5.3.1","v5.3.0","v5.2.0","v5.1.3","v5.1.2","v5.1.1","v5.1.0","v5.0.1","v5.0.0","v4.0.0","v3.1.0","v3.0.2","v3.0.1","v3.0.0","v1.0.0","v0.4.5","v0.4.4","v0.4.3","v0.4.2","v0.4.1","v0.4.0","v0.3.6","v0.3.5","v0.3.4","v0.3.3","v0.3.1","v0.3.0","v0.2.9","v0.2.8","v0.2.7","0.2.7","v0.2.6","v0.2.4","v0.2.5","v0.2.3","v0.2.2","v0.2.1","v0.2.0","v0.0.19","v0.0.18","v0.0.17","v0.0.16","v0.0.15","v0.0.14","v0.0.13","v0.0.12","v0.0.11","v0.0.10","v0.0.9","v0.0.8","v0.0.7","v0.0.6","v0.0.5","v0.0.4","v0.0.3","v0.0.2","v0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85063.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}]}