{"uuid": "e9f64d19-4a87-4fa3-b17a-cbfad1acccf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104861", "type": "seen", "source": "https://gist.github.com/alon710/97cc08d3ade1a2a102e89c6da7267a8f", "content": "# CVE-2026-104861: CVE-2026-104861: Quadratic-time Regular Expression Denial of Service in probe-image-size SVG Parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-10-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-104861\n\n## Summary\nAn uncontrolled resource consumption vulnerability (CWE-1333 / CWE-400) exists in probe-image-size versions prior to 7.4.0. The SVG parser utilizes an unanchored, inefficient regular expression to find the SVG root tag, leading to catastrophic backtracking when handling malformed payloads. This blocks the single-threaded Node.js event loop, resulting in a complete denial of service.\n\n## TL;DR\nUnauthenticated remote attackers can cause complete CPU exhaustion and Denial of Service in Node.js applications using probe-image-size by supplying malformed SVG streams with unclosed opening brackets.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1333, CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Severity Score**: 7.5 (High)\n- **EPSS Score**: 0.00043\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof of Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- probe-image-size (npm package)\n- **probe-image-size**: < 7.4.0 (Fixed in: `7.4.0`)\n\n## Mitigation\n\n- Upgrade probe-image-size to version 7.4.0 or later.\n- Deploy WAF rules to reject XML/SVG requests larger than 10 KB.\n- Implement request timeouts on image download endpoints to prevent streaming connection hanging.\n\n**Remediation Steps:**\n1. Identify applications utilizing the probe-image-size package.\n2. Update package.json dependencies to specify version ^7.4.0.\n3. Run npm update probe-image-size or yarn upgrade probe-image-size to apply the patch.\n4. Deploy the updated application to production and monitor CPU usage patterns.\n\n## References\n\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-104861)\n- [CVE.org Authoritative Record](https://www.cve.org/CVERecord?id=CVE-2026-104861)\n- [GitHub Security Advisory](https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-104861) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-03T00:30:30.000000Z"}