CVE-2026-104861

{
  "etk_id": "ETK-2026-392",
  "cve_id": "CVE-2026-104861",
  "display_id": "CVE-2026-104861",
  "ghsa_id": "GHSA-gjj5-9665-rwrc",
  "euvd_id": "EUVD-2026-91768",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Quadratic parsing denial of service in probe-image-size",
  "summary": "probe-image-size versions before 7.4.0 can spend excessive CPU time while examining malformed SVG input, delaying other work on the Node.js event loop. An attacker must be able to provide image content or a URL that reaches the synchronous, streaming, or URL parsing interface.",
  "mitigation": "Upgrade probe-image-size to version 7.4.0 or later. Until upgraded, restrict untrusted image inputs and remote URLs reaching the parser.",
  "vendor": "nodeca",
  "product": "probe-image-size",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<=7.3.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "7.4.0"
      ],
      "package_name": "probe-image-size",
      "purl": "pkg:npm/probe-image-size"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": 0.0043,
  "epss_percentile": 0.3545,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.380206066666666,
  "t0_at": "2026-10-02T17:56:15.515000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-08-15T06:16:01+00:00",
      "days": -48.486279108796296,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T17:56:15.515000+00:00",
      "url": "https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc"
    },
    "trigger_signal": {
      "at": "2026-10-02T17:56:15.515000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T17:56:15.515000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104861"
    }
  }
}