Uncontrolled resource consumption in jpeg-js

Description

Uncontrolled resource consumption in jpeg-js before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image.

Recommendation

Update the jpeg-js package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.4.0
• Patched version(s): 0.4.0

References

• GHSA-w7q9-p3jq-fmhm
• hackerone.com
• CVE-2020-8175
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• mpregular vulnerable to prototype pollution - CVE-2025-57323
• DOMPurify allows Cross-site Scripting (XSS) - CVE-2025-26791
• lite-server vulnerable to Denial of Service - CVE-2022-25940
• Manifest Uses a One-Way Hash without a Salt - CVE-2025-27408

Tags:

npm

jpeg-js