CVE-2026-85063: node-csv: Prototype replacement still reachable via columns path

September 8, 2026

With columns: true and group_columns_by_name: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj[’proto’], invoking the proto setter and replacing the parsed record object’s prototype with attacker-controlled data. Fixed in 7.0.2 (Object.hasOwn duplicate check + Object.defineProperty assignment).

References

github.com/adaltas/node-csv/commit/eb4d1484589c976dcb977db8dd0b90e015a6f66e
github.com/adaltas/node-csv/issues/496
github.com/adaltas/node-csv/pull/497
github.com/adaltas/node-csv/security/advisories/GHSA-8cw4-87c7-c6xx
github.com/advisories/GHSA-8cw4-87c7-c6xx
nvd.nist.gov/vuln/detail/CVE-2026-85063

Code Behaviors & Features

Detect and mitigate CVE-2026-85063 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →