CVE-2026-8814
Medium · 5.3CVSS
5.3
EPSS
0.5%
Published
May 19, 2026
CISA due date
—
The record
Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When asynchronous parsing is enabled, a crafted PNG file containing a highly compressed zTXt chunk can cause ExifReader to materialize a disproportionately large Comment value in memory.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | exifreader | 4.20.0 | 4.39.0 |
Related vulnerabilities
- GHSA-rr89-w3h9-m66j ExifReader is vulnerable to denial of service via unbounded decompression of image… Same vulnerability
- GHSA-h64w-w9pr-82m4 ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag Also affects exifreader
- CVE-2026-8813 This affects versions of the package exifreader before 4.39.0. Also affects exifreader
- CVE-2026-92823 A flaw was found in libmodulemd. CWE-409
- CVE-2026-112892 Pillow is a Python imaging library. CWE-409
- CVE-2026-107227 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-409
- CVE-2026-107210 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-409
- CVE-2026-106585 In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet… CWE-409