Skip to content
OpenAdvisories

Package · npm

exifreader

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-85715

    ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

    ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems() within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an …

    mattiasw ExifReader exifreader npm
  • High 7.5
    CVE-2026-8813

    ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag

    This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends…

    exifreader npm