Read the docs
TI-2026-07747 Aliases CVE-2026-8814GHSA-rr89-w3h9-m66j

Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of…

Priority HIGH 70CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When asynchronous parsing is enabled, a crafted PNG file containing a highly compressed zTXt chunk can cause ExifReader to materialize a disproportionately large Comment value in memory.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00465 40th percentileScored 2026-11-07
Fix Fixed exifreader: 4.39.0exifreader (npm): 4.39.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—exifreaderbefore 4.39.04.39.0Patch availableCNA
—exifreader (npm)4.20.0 to before 4.39.04.39.0Patch availableGHSA-rr89-w3h9-m66j
  • exifreader Vendor— Affected before 4.39.0 Fixed in 4.39.0 Patch available CNA
  • exifreader (npm) Vendor— Affected 4.20.0 to before 4.39.0 Fixed in 4.39.0 Patch available GHSA-rr89-w3h9-m66j

Remediation

  • Fix · CNA exifreader Fixed in 4.39.0
  • Fix · GHSA-rr89-w3h9-m66j exifreader (npm) Fixed in 4.39.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    exifreader 4.39.0

    2 records Highest priority Priority HIGH 2 HIGH

    Other records, highest priority first

    • TI-2026-07746 This affects versions of the package exifreader before 4.39.0.Priority HIGH 77
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-8814
  2. 2026-10-03 Alias added: GHSA-rr89-w3h9-m66j

References

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences