Skip to content
OpenAdvisories

Package · npm

exifreader

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 7.5
    CVE-2026-85715

    ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

    ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems() within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an …

    mattiasw ExifReader exifreader npm
  • Medium 5.3
    CVE-2026-53496

    ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

    ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox() and parse…

    mattiasw ExifReader exifreader npm
  • Medium 5.3
    CVE-2026-8814

    ExifReader is vulnerable to denial of service via unbounded decompression of image metadata

    Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When asynchronous parsing…

    exifreader npm
  • High 7.5
    CVE-2026-8813

    ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag

    This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends…

    exifreader npm