Read the docs
TI-2025-41208 Aliases CVE-2025-67419GHSA-m2q5-xhqg-92r2

A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows…

Priority LOW 39CWE-1050Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the processing of SVG files, resulting in unbounded resource consumption and system-wide denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00346 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—@evershop/evershop (npm)up to 2.1.0—No fix listedGHSA-m2q5-xhqg-92r2
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • @evershop/evershop (npm) Vendor— Affected up to 2.1.0 Fixed in — No fix listed GHSA-m2q5-xhqg-92r2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:evershop:evershop:*:*:*:*:*:node.js:*:*up to 2.1.0VulnerableEvershop
  • cpe:2.3:a:evershop:evershop:*:*:*:*:*:node.js:*:* Versions up to 2.1.0 Vulnerable ·Evershop

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-67419
  2. 2026-10-03 Alias added: GHSA-m2q5-xhqg-92r2

References

Advisory 2

Other 2

  • TI-2025-40481 EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and… CVSS 3.1HIGH 7.5
  • TI-2025-11836 EverShop Order Order.resolvers.js resource injection CVSS 4.0MEDIUM 6.3
  • TI-2026-22548 EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response CVSS 3.1CRITICAL 9.8
  • TI-2023-25344 An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. CVSS 3.1CRITICAL 9.1
  • TI-2026-21008 EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys CVSS 4.0CRITICAL 9.3
  • TI-2023-25039 An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain… CVSS 3.1CRITICAL 9.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences