CVE-2026-8813: Improper Validation of Specified Quantity in Input

This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficien...

@activeboxes/piece-image-helper (0.1.0), @activepieces/piece-image-helper (>=0.0.5, <=0.1.13) +20 more potentially affected by CVE-2026-8814 via exifreader (>=4.1.1, <=4.38.1)

exifreader NPM version =4.1.1, =0.0.5, =0.1.0, =1.18.1-dev.1638815480459, =1.0.2, =1.0.6, =4.10.0, =1.0.0-beta.141, =0.0.8, =0.0.0-unstable.6844005670, =6.4.0-beta.0 and more Source cves: CVE-2026-8814 Source advisory: SNYK:JS-EXIFREADER-16689340...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview exifreader is a Library that parses Exif metadata in images. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When...

Improper Validation of Specified Quantity in Input

Overview exifreader is a Library that parses Exif metadata in images. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size...

@activeboxes/piece-image-helper (0.1.0), @activepieces/piece-image-helper (>=0.0.5, <=0.1.13) +20 more potentially affected by CVE-2026-8813 via exifreader (>=4.1.1, <=4.38.1)

exifreader NPM version =4.1.1, =0.0.5, =0.1.0, =1.18.1-dev.1638815480459, =1.0.2, =1.0.6, =4.10.0, =1.0.0-beta.141, =0.0.8, =0.0.0-unstable.6844005670, =6.4.0-beta.0 and more Source cves: CVE-2026-8813 Source advisory: SNYK:JS-EXIFREADER-16689335...