CVE-2025-67419
High · 7.5evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API
CVSS
7.5
EPSS
0.3%
Published
Jan 5, 2026
CISA due date
—
The record
A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the processing of SVG files, resulting in unbounded resource consumption and system-wide denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @evershop/evershop | 0 | No fix |
Related vulnerabilities
- GHSA-m2q5-xhqg-92r2 evershop allows unauthenticated attackers to exhaust application server's resources via… Same vulnerability
- GHSA-vp8w-wj4m-3r7j evershop allows unauthenticated attackers to force server to initiate HTTP request via… Also affects @evershop/evershop
- CVE-2025-67427 evershop allows unauthenticated attackers to force server to initiate HTTP request via… Also affects @evershop/evershop
- GHSA-c73g-mx2w-cc93 EverShop is vulnerable to Unauthorized Order Information Access (IDOR) Also affects @evershop/evershop
- CVE-2025-12919 A vulnerability was detected in EverShop up to 2.0.1. Also affects @evershop/evershop
- CVE-2026-85977 A flaw was found in libtirpc. CWE-1050
- CVE-2026-94287 A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19… CWE-1050
- CVE-2026-81736 If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried… CWE-1050