npm/muhammara CVE-2026-125107: high 7.5
Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key
Action: Upgrade muhammara to 6.0.5 or later.
npm i muhammara@6.0.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.0.5 | - |
Fixed versions
| 6.0.5 |
Sources
- osv: GHSA-fhp4-pr5j-46m5
- https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5
- https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b
- https://github.com/julianhille/MuhammaraJS
CVE-2026-125107 · published · modified · JSON