High, CVSS 7.5npmAmendedPublished
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
CVE-2026-104861 · GHSA-gjj5-9665-rwrc
- Affected
- npm probe-image-size <= 7.3.0
- Fixed in
- 7.4.0· Vendor fix available
- Issue
- probe-image-size scans the SVG header with a searching regular expression, /<[-.:a-zA-Z0-9][^]/. On input that contains many < characters but no , the engine restarts the [^] scan at every < position and runs to end of input each time, giving quadratic time complexity. Both the synchronous and the streaming parser are affected. Impact Every entry point that reaches the SVG parser is affected: probe.sync(), probe(stream) and probe(url). The URL form is the most exposed one — the input is fetched from a remote host, so an attacker only needs to supply a link. Processing a crafted buffer blocks the Node.js event loop at 100% CPU for the whole duration. In production environments such as upload validators, image proxies or link unfurl services, a small number of concurrent requests is enough to deny service. Root Cause Analysis Two independent problems. 1. Absence of input size cap in the sync path. lib/parsesync/svg.js copied the entire buffer into a string and matched against…
Recommended action: Upgrade to 7.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.