Skip to content
OpenAdvisories

Package · npm

exifreader

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-53496

    ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

    ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox() and parse…

    mattiasw ExifReader exifreader npm
  • Medium 5.3
    CVE-2026-8814

    ExifReader is vulnerable to denial of service via unbounded decompression of image metadata

    Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When asynchronous parsing…

    exifreader npm