{"id":"CVE-2026-104861","published":"2026-10-02T18:17:02.430","lastModified":"2026-10-02T19:16:41.137","description":"probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without a closing greater-than character. The synchronous parser converts and scans the full supplied buffer without an input cap, while the streaming parser reparses the complete accumulated SVG prefix for every received chunk. The probe.sync(), probe(stream), and probe(url) entry points can therefore block the Node.js event loop at full CPU, and attacker-controlled chunking can amplify the streaming cost. This issue is fixed in version 7.4.0.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400","CWE-1333"],"vendors":[],"products":[],"references":[{"url":"https://github.com/nodeca/probe-image-size/commit/60cc96ac0b671e79e328213d0a8e831312b09e84","tags":[]},{"url":"https://github.com/nodeca/probe-image-size/commit/9b74656d6f973cc59ea2ab1375c0d88390a402ad","tags":[]},{"url":"https://github.com/nodeca/probe-image-size/commit/c032aefabdecf5cb50548ab9ba175db56353078f","tags":[]},{"url":"https://github.com/nodeca/probe-image-size/releases/tag/7.4.0","tags":[]},{"url":"https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc","tags":[]},{"url":"https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc","tags":[]}],"exploitRefs":[{"url":"https://github.com/nodeca/probe-image-size/commit/60cc96ac0b671e79e328213d0a8e831312b09e84","tags":[]},{"url":"https://github.com/nodeca/probe-image-size/commit/9b74656d6f973cc59ea2ab1375c0d88390a402ad","tags":[]},{"url":"https://github.com/nodeca/probe-image-size/commit/c032aefabdecf5cb50548ab9ba175db56353078f","tags":[]},{"url":"https://github.com/nodeca/probe-image-size/releases/tag/7.4.0","tags":[]},{"url":"https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc","tags":[]},{"url":"https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc","tags":[]}],"hasPoc":true,"ai":{"summary":"The probe-image-size library has a denial-of-service vulnerability where attacker-controlled SVG data can cause excessive CPU usage and event loop blocking. This occurs because the parsing regex repeatedly scans to the end of input when malformed SVG contains many unclosed tags, leading to full buffer scanning without limits.","exploitability":"Exploitation is relatively straightforward as it requires only sending specially crafted SVG data that triggers the regex backtracking behavior, with no special preconditions needed.","blast_radius":"In a web application context, this could allow an attacker to cause significant CPU load and event loop blocking across many concurrent requests, potentially leading to service unavailability or degraded performance for all users.","remediation":"Upgrade to version 7.4.0 or later which fixes the regex backtracking issue in both synchronous and streaming SVG parsing.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","svg","nodejs","cpu"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:02:39.984Z"}}