probe-image-size: Quadratic-time Denial of Service in the SVG Parser

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-104861 · Microsoft / collected KEV context

EUVD-2026-91768

GHSA-gjj5-9665-rwrc

cve-program · CVE-2026-104861

• https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc
• https://github.com/nodeca/probe-image-size/commit/60cc96ac0b671e79e328213d0a8e831312b09e84
• https://github.com/nodeca/probe-image-size/commit/9b74656d6f973cc59ea2ab1375c0d88390a402ad
• https://github.com/nodeca/probe-image-size/commit/c032aefabdecf5cb50548ab9ba175db56353078f
• https://github.com/nodeca/probe-image-size/releases/tag/7.4.0

euvd · EUVD-2026-91768

• https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc
• https://github.com/nodeca/probe-image-size/commit/60cc96ac0b671e79e328213d0a8e831312b09e84
• https://github.com/nodeca/probe-image-size/commit/9b74656d6f973cc59ea2ab1375c0d88390a402ad
• https://github.com/nodeca/probe-image-size/commit/c032aefabdecf5cb50548ab9ba175db56353078f
• https://github.com/nodeca/probe-image-size/releases/tag/7.4.0

nvd · CVE-2026-104861

• https://github.com/nodeca/probe-image-size/commit/60cc96ac0b671e79e328213d0a8e831312b09e84
• https://github.com/nodeca/probe-image-size/commit/9b74656d6f973cc59ea2ab1375c0d88390a402ad
• https://github.com/nodeca/probe-image-size/commit/c032aefabdecf5cb50548ab9ba175db56353078f
• https://github.com/nodeca/probe-image-size/releases/tag/7.4.0
• https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc

osv · GHSA-gjj5-9665-rwrc

• https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc
• https://nvd.nist.gov/vuln/detail/CVE-2026-104861
• https://github.com/nodeca/probe-image-size/commit/60cc96ac0b671e79e328213d0a8e831312b09e84
• https://github.com/nodeca/probe-image-size/commit/9b74656d6f973cc59ea2ab1375c0d88390a402ad
• https://github.com/nodeca/probe-image-size/commit/c032aefabdecf5cb50548ab9ba175db56353078f
• https://github.com/nodeca/probe-image-size
• https://github.com/nodeca/probe-image-size/releases/tag/7.4.0

• probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/, which repeatedly scans to the end o… · Advisory content revised · 1 Nov 2026