CVE-2026-104861

npm/probe-image-size CVE-2026-104861: high 7.5, EPSS 0.43%

probe-image-size: Quadratic-time Denial of Service in the SVG Parser

Action: Upgrade probe-image-size to 7.4.0 or later.

npm i probe-image-size@7.4.0

Affected

Fixed versions

Sources

• osv: GHSA-gjj5-9665-rwrc
• https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc
• https://nvd.nist.gov/vuln/detail/CVE-2026-104861
• https://github.com/nodeca/probe-image-size/commit/60cc96ac0b671e79e328213d0a8e831312b09e84
• https://github.com/nodeca/probe-image-size/commit/9b74656d6f973cc59ea2ab1375c0d88390a402ad
• https://github.com/nodeca/probe-image-size/commit/c032aefabdecf5cb50548ab9ba175db56353078f
• https://github.com/nodeca/probe-image-size
• https://github.com/nodeca/probe-image-size/releases/tag/7.4.0

CVE-2026-104861 · published 2026-10-02T23:18:02Z · modified 2026-10-02T23:30:06.744851556Z · JSON