Description
Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When asynchronous parsing is enabled, a crafted PNG file containing a highly compressed zTXt chunk can cause ExifReader to materialize a disproportionately large Comment value in memory.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | exifreader | < 4.39.0 | 4.39.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | exifreader | >= 4.20.0, < 4.39.0 | 4.39.0 | GHSA-rr89-w3h9-m66j |