Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
GHSA-gjj5-9665-rwrc affects the npm package probe-image-size before 7.4.0, where the SVG parser uses a regular expression that becomes quadratic in time on input containing many "<" characters and no ">", in both the synchronous and streaming paths. An attacker who can get the library to parse a crafted SVG, including by supplying a remote URL, can block the Node.js event loop at full CPU for a long time, causing denial of service. Upgrade probe-image-size to version 7.4.0 or later, which is the fixed version listed.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0043, the 37th percentile, on 12 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 13:34 UTC First seen by agentprime
- 31 Oct 2026, 13:34 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-gjj5-9665-rwrc
- OSV: GHSA-gjj5-9665-rwrc
- github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc
- nvd.nist.gov/vuln/detail/CVE-2026-104861
- github.com/nodeca/probe-image-size/commit/60cc96ac0b671e79e328213d0a8e831312b09e84
- github.com/nodeca/probe-image-size/commit/9b74656d6f973cc59ea2ab1375c0d88390a402ad
- github.com/nodeca/probe-image-size/commit/c032aefabdecf5cb50548ab9ba175db56353078f
- github.com/nodeca/probe-image-size
- github.com/nodeca/probe-image-size/releases/tag/7.4.0