Ag Psd
Monthly
Uncontrolled memory allocation in ag-psd's readPsd() lets a remote attacker crash any Node service that parses untrusted Photoshop files: the reader sizes off-heap typed-array buffers from attacker-declared header geometry (width, height, channels, depth and per-layer rectangles) before validating those declarations against the bytes actually present, so a 52-byte PSD can commit roughly 3.17 GB of peak RSS in about 0.45 seconds before a RangeError is raised. All npm releases up to and including 30.2.0 are affected, CVSS 3.1 scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-789), and no authentication, interaction or special configuration is needed - only exposure to attacker-supplied PSD input with default read options. The flaw is not listed in CISA KEV, but the vendor advisory publishes a working 52-byte proof-of-concept input (sha256 a1146a6f…) together with reproduction steps; this is a real, actionable denial-of-service issue rather than a critical emergency, and remediation should be scheduled this week for any service that accepts user-uploaded PSDs.
Uncontrolled memory allocation in ag-psd's readPsd() lets a remote attacker crash any Node service that parses untrusted Photoshop files: the reader sizes off-heap typed-array buffers from attacker-declared header geometry (width, height, channels, depth and per-layer rectangles) before validating those declarations against the bytes actually present, so a 52-byte PSD can commit roughly 3.17 GB of peak RSS in about 0.45 seconds before a RangeError is raised. All npm releases up to and including 30.2.0 are affected, CVSS 3.1 scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-789), and no authentication, interaction or special configuration is needed - only exposure to attacker-supplied PSD input with default read options. The flaw is not listed in CISA KEV, but the vendor advisory publishes a working 52-byte proof-of-concept input (sha256 a1146a6f…) together with reproduction steps; this is a real, actionable denial-of-service issue rather than a critical emergency, and remediation should be scheduled this week for any service that accepts user-uploaded PSDs.