npmPackage

exifreader

4 known vulnerabilities (2 high, 2 medium), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-85715High 7.5
ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion
Affected: fixed in 4.41.1.
Fixed in 4.41.1 (released Jul 18, 2026, 61 days before disclosure).
The latest release, 4.54.0, is not affected.
40% of exifreader downloads last week were affected versions (201.9K).
CVE-2026-53496Medium 5.3
ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes
Affected: fixed in 4.40.1.
Fixed in 4.40.1 (released May 30, 2026, 107 days before disclosure).
The latest release, 4.54.0, is not affected.
36% of exifreader downloads last week were affected versions (183.5K).
CVE-2026-8814Medium 6.9
Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to…
Affected: from 4.20.0, fixed in 4.39.0.
Fixed in 4.39.0 (released May 15, 2026, 4 days before disclosure).
The latest release, 4.54.0, is not affected.
30% of exifreader downloads last week were affected versions (153.2K).
CVE-2026-8813High 8.7
This affects versions of the package exifreader before 4.39.0.
Affected: from 2.10.0, fixed in 4.39.0.
Fixed in 4.39.0 (released May 15, 2026, 4 days before disclosure).
The latest release, 4.54.0, is not affected.
34% of exifreader downloads last week were affected versions (170K).