CVE-2026-104861: probe-image-size: Quadratic-time Denial of Service in the SVG Parser
Every entry point that reaches the SVG parser is affected: probe.sync(), probe(stream) and probe(url). The URL form is the most exposed one — the input is fetched from a remote host, so an attacker only needs to supply a link.
Processing a crafted buffer blocks the Node.js event loop at 100% CPU for the whole duration. In production environments such as upload validators, image proxies or link unfurl services, a small number of concurrent requests is enough to deny service.
References
- github.com/advisories/GHSA-gjj5-9665-rwrc
- github.com/nodeca/probe-image-size/commit/60cc96ac0b671e79e328213d0a8e831312b09e84
- github.com/nodeca/probe-image-size/commit/9b74656d6f973cc59ea2ab1375c0d88390a402ad
- github.com/nodeca/probe-image-size/commit/c032aefabdecf5cb50548ab9ba175db56353078f
- github.com/nodeca/probe-image-size/releases/tag/7.4.0
- github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc
- nvd.nist.gov/vuln/detail/CVE-2026-104861
Code Behaviors & Features
Detect and mitigate CVE-2026-104861 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →