CVE-2026-104861

Summary

The probe-image-size library has a denial-of-service vulnerability where attacker-controlled SVG data can cause excessive CPU usage and event loop blocking. This occurs because the parsing regex repeatedly scans to the end of input when malformed SVG contains many unclosed tags, leading to full buffer scanning without limits.

Exploitability

Exploitation is relatively straightforward as it requires only sending specially crafted SVG data that triggers the regex backtracking behavior, with no special preconditions needed.

Blast radius

In a web application context, this could allow an attacker to cause significant CPU load and event loop blocking across many concurrent requests, potentially leading to service unavailability or degraded performance for all users.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 7.4.0 or later which fixes the regex backtracking issue in both synchronous and streaming SVG parsing.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.