ag-psd CVE-2026-63501

Exploitable only when an application uses ag-psd to parse attacker-supplied PSD files on the server with layer decoding enabled (the default readPsd path, e.g. useImageData); the attacker controls the PSD's layer bounds (top/left/bottom/right) to drive createImageDataBitDepth into a huge Uint16Array allocation, and a second path abuses inflateSync on ZIP-encoded channel data with no output-size cap (ZIP-bomb-style). The totalMemoryLimit option does not limit this because it is never forwarded as memoryLimit, so callers relying on it are not actually protected. Limiting factors: the affected application must accept and decode untrusted PSD input and be running a version at or below 31.0.0; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required, and no non-default configuration is needed since layer decoding is on by default. Impact is availability-only (process memory exhaustion / crash); there is no confidentiality or integrity effect.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated availability-only impact - consistent with the CWE-770 uncontrolled memory allocation described. There is no KEV listing and no EPSS score in the provided data, so there is no evidence of active exploitation; however, a complete, self-contained working PoC (Node.js inline script plus Dockerfile and Python reproduction with expected output showing a 1 KB totalMemoryLimit bypassed to allocate 200 MB from an 86-byte file) is published in the GHSA advisory, so publicly available exploit code exists. The vuln.today Decision label is 'this_week', which aligns with a serious-but-not-emergency DoS: real and trivially reproducible, but confidentiality and integrity are unaffected (C:N/I:N). The practical priority is bounded by exposure - this only matters to applications that parse attacker-supplied PSD files server-side with layer decoding enabled (the default). The one documented defense, the totalMemoryLimit option, is silently non-functional due to a property-name mismatch, so callers who believed they were protected are not. Note a data conflict to verify: the CVE Description text says both 'Prior to 31.0.3' and 'fixed in 31.0.1', and the referenced release tag is 31.0.3, while the commit diff and npm package advisory both state the fix landed in 31.0.1 - treat 31.0.1 as the confirmed first fixed version per the code evidence and verify the 31.0.3 reference with the vendor.

An attacker uploads a single crafted PSD file (as small as 86 bytes) to a web service that uses ag-psd for server-side PSD preview, conversion, or editing with layer decoding enabled. Attacker-controlled layer dimensions (e.g. 5000×5000 at 16-bit, 4 channels) force a ~200 MB allocation that bypasses the configured totalMemoryLimit, and repeated or large requests exhaust process heap and crash the Node.js process via the OS OOM killer. A complete working PoC demonstrating the bypass is published in the GHSA advisory.