ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag

Description

When parsing an image with an embedded ICC profile that contains a crafted multiLocalizedUnicodeType (mluc) tag, ExifReader can be made to allocate memory proportional to attacker-controlled fields in the tag rather than to the actual size of the input.

Recommendation

Update the exifreader package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.10.0, < 4.39.0
• Patched version(s): 4.39.0

References

• GHSA-h64w-w9pr-82m4
• security.snyk.io
• CVE-2026-8813
• CWE-1284
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Cube Core is vulnerable to Denial of Service (DoS) via crafted request - CVE-2026-25957
• ExifReader is vulnerable to denial of service via unbounded decompression of image metadata - CVE-2026-8814
• React Router vulnerable to Denial of Service via reflected user input in single-fetch - CVE-2026-34077
• jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder - CVE-2026-24133

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

exifreader