GHSA-rr89-w3h9-m66j
Medium · 5.3CVSS
5.3
EPSS
—
Published
May 29, 2026
CISA due date
—
The record
ExifReader is vulnerable to denial of service via unbounded decompression of image metadata
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | exifreader | 4.20.0 | 4.39.0 |
Related vulnerabilities
- CVE-2026-8814 Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of… Same vulnerability
- GHSA-h64w-w9pr-82m4 ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag Also affects exifreader
- CVE-2026-8813 This affects versions of the package exifreader before 4.39.0. Also affects exifreader
- CVE-2026-92823 A flaw was found in libmodulemd. CWE-409
- CVE-2026-112892 Pillow is a Python imaging library. CWE-409
- CVE-2026-107227 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-409
- CVE-2026-107210 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-409
- CVE-2026-106585 In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet… CWE-409