Probe Image Size
Monthly
Denial of service in probe-image-size before 7.4.0 lets remote, unauthenticated attackers pin a Node.js process at full CPU and block its event loop by feeding crafted SVG-like data through probe.sync(), probe(stream), or probe(url). The SVG parser's searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/ rescans to the end of the input whenever attacker-controlled data contains many '<' characters with no closing '>', and the synchronous path converts and scans an entire uncapped buffer while the streaming path reparses the full accumulated SVG prefix on every chunk, so attacker-controlled chunking amplifies the cost. No public exploit code was identified at time of analysis, but the attack is trivial to trigger in any application that passes untrusted image bytes or URLs to the library, and the vendor-released patch is version 7.4.0.
Denial of service in probe-image-size before 7.4.0 lets remote, unauthenticated attackers pin a Node.js process at full CPU and block its event loop by feeding crafted SVG-like data through probe.sync(), probe(stream), or probe(url). The SVG parser's searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/ rescans to the end of the input whenever attacker-controlled data contains many '<' characters with no closing '>', and the synchronous path converts and scans an entire uncapped buffer while the streaming path reparses the full accumulated SVG prefix on every chunk, so attacker-controlled chunking amplifies the cost. No public exploit code was identified at time of analysis, but the attack is trivial to trigger in any application that passes untrusted image bytes or URLs to the library, and the vendor-released patch is version 7.4.0.