CVE-2026-104861

Name of the Vulnerable Software and Affected Versions probe-image-size versions prior to 7.4.0

Description A Regular Expression Denial of Service (ReDoS) exists when processing SVG files. The library uses the regular expression /<[- .:a-zA-Z0-9][^>]*>/ in lib/parse sync/svg.js and lib/parse stream/svg.js, which can repeatedly scan to the end of the input if the data contains many less-than characters without a closing greater-than character. The synchronous parser scans the full buffer without an input cap, and the streaming parser reparses the accumulated SVG prefix for every chunk. This can block the Node.js event loop at full CPU via the probe.sync(), probe(stream), and probe(url) entry points.

Recommendations Update to version 7.4.0.