High, CVSS 7.5npmAmendedPublished
ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)
CVE-2026-63501 · GHSA-6w3r-6hpr-hp6p
- Affected
- npm ag-psd < 31.0.1
- Fixed in
- 31.0.1· Vendor fix available
- Issue
- The `readPsd()` function in `ag-psd` accepts a `totalMemoryLimit` option to cap memory usage when parsing untrusted PSD files, but this limit is never forwarded to the layer image buffer allocation path. A property name mismatch (`totalMemoryLimit` vs. `memoryLimit`) causes the size guard inside `createImageDataBitDepth` to be skipped unconditionally. An attacker who can supply a crafted PSD to any application using `ag-psd` for server-side parsing can force an unbounded heap allocation — a 5000×5000 layer in a 86-byte file allocates 200 MB — leading to denial of service through process memory exhaustion regardless of what limit the caller specified. Details `readPsd()` (exported from `src/index.ts:22`) wraps caller-supplied bytes in a `PsdReader` object that inherits `ReadOptions`, which defines `totalMemoryLimit?: number` (`src/psd.ts:1819`). A default of 2 GB is written into the reader at `src/psdReader.ts:237`. When the parser reaches a layer, it calls…
Recommended action: Upgrade to 31.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.