ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

Description

ExifReader 4.40.0 can throw an uncaught RangeError: Offset is outside the bounds of the DataView while parsing crafted HEIC/AVIF files. The file only needs a valid leading ftyp box with a HEIC/AVIF major brand followed by a malformed ISO-BMFF box, such as an empty 8-byte free box or a truncated extended-size box.

Recommendation

Update the exifreader package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.40.0
• Patched version(s): 4.40.1

References

• GHSA-g77h-45rf-hcx4
• CVE-2026-53496
• CWE-248
• CWE-755
• CAPEC-310
• OWASP 2021-A6

Related Issues

• joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas - CVE-2026-48038
• fast-xml-parser has RangeError DoS Numeric Entities Bug - CVE-2026-25128
• fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026- - CVE-2026-33036
• fast-xml-parser has stack overflow in XMLBuilder with preserveOrder - CVE-2026-27942

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

exifreader