{"action":"Upgrade probe-image-size to 7.4.0 or later.","affected":[{"fixed":"7.4.0","introduced":"0"}],"component":"probe-image-size","cve_ids":["CVE-2026-104861"],"ecosystem":"npm","epss":0.00425,"exploited":false,"fixed_versions":["7.4.0"],"ghsa_id":"GHSA-gjj5-9665-rwrc","id":"tcs_01M5KFRVZ16G3WWA9C64R1JXFQ","modified_at":"2026-10-02T23:30:06.744851556Z","published_at":"2026-10-02T23:18:02Z","references":["https://osv.dev/vulnerability/GHSA-gjj5-9665-rwrc","https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc","https://nvd.nist.gov/vuln/detail/CVE-2026-104861","https://github.com/nodeca/probe-image-size/commit/60cc96ac0b671e79e328213d0a8e831312b09e84","https://github.com/nodeca/probe-image-size/commit/9b74656d6f973cc59ea2ab1375c0d88390a402ad","https://github.com/nodeca/probe-image-size/commit/c032aefabdecf5cb50548ab9ba175db56353078f","https://github.com/nodeca/probe-image-size","https://github.com/nodeca/probe-image-size/releases/tag/7.4.0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-gjj5-9665-rwrc","url":"https://osv.dev/vulnerability/GHSA-gjj5-9665-rwrc"}],"summary":"probe-image-size: Quadratic-time Denial of Service in the SVG Parser"}