CVE-2026-104861

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without a closing greater-than character. The synchronous parser converts and scans the full supplied buffer without an input cap, while the streaming parser reparses the complete accumulated SVG prefix for every received chunk. The probe.sync(), probe(stream), and probe(url) entry points can therefore block the Node.js event loop at full CPU, and attacker-controlled chunking can amplify the streaming cost. This issue is fixed in version 7.4.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/nodeca/probe-image-size/commit/60cc96ac0b671e79e328213d0a8e831312b09e84
https://github.com/nodeca/probe-image-size/commit/9b74656d6f973cc59ea2ab1375c0d88390a402ad
https://github.com/nodeca/probe-image-size/commit/c032aefabdecf5cb50548ab9ba175db56353078f
https://github.com/nodeca/probe-image-size/releases/tag/7.4.0
https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc
https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc

Configurations

No configuration.

History

02 Oct 2026, 19:16

Type	Values Removed	Values Added
References	~~() https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc -~~	() https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc -

02 Oct 2026, 18:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-02 18:17

Updated : 2026-10-02 19:16

NVD link : CVE-2026-104861

Mitre link : CVE-2026-104861

CVE.ORG link : CVE-2026-104861

JSON object : View

Products Affected

No product.

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2026-104861", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-104861", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-02T18:19:55.305774Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nodeca", "product": "probe-image-size", "versions": [{"status": "affected", "version": "< 7.4.0"}]}]}], "published": "2026-10-02T18:17:02.430", "references": [{"url": "https://github.com/nodeca/probe-image-size/commit/60cc96ac0b671e79e328213d0a8e831312b09e84", "source": "security-advisories@github.com"}, {"url": "https://github.com/nodeca/probe-image-size/commit/9b74656d6f973cc59ea2ab1375c0d88390a402ad", "source": "security-advisories@github.com"}, {"url": "https://github.com/nodeca/probe-image-size/commit/c032aefabdecf5cb50548ab9ba175db56353078f", "source": "security-advisories@github.com"}, {"url": "https://github.com/nodeca/probe-image-size/releases/tag/7.4.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc", "source": "security-advisories@github.com"}, {"url": "https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without a closing greater-than character. The synchronous parser converts and scans the full supplied buffer without an input cap, while the streaming parser reparses the complete accumulated SVG prefix for every received chunk. The probe.sync(), probe(stream), and probe(url) entry points can therefore block the Node.js event loop at full CPU, and attacker-controlled chunking can amplify the streaming cost. This issue is fixed in version 7.4.0."}], "lastModified": "2026-10-02T19:16:41.137", "sourceIdentifier": "security-advisories@github.com"}