CVE-2026-53496Medium· 5.3▾ TwilightPoC availableExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where f…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.5%
0.5% → 0.5%
Last analysed / modified upstream
ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox() and parseBox() accept an eight-byte box header without confirming that fields required by the parsed box remain in the DataView. A valid ftyp box followed by an empty free or unknown box can cause an unchecked full-box version read, while a truncated extended-size box can make getBoxLength() and hasEmptyHighBits() read absent size fields. The resulting RangeError escapes the main parsing path and can abort an application request or worker when parse errors are not defensively caught, causing denial of service. This issue is fixed in version 4.40.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
exifreader <= 4.40.0Patched in:
exifreader 4.40.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85715High· 7.5ExifReader is a JavaScript Exif information parser
CVE-2026-102274Medium· 5.9PyJWT is a Python implementation of JSON Web Token standards
CVE-2026-113872High· 7.5multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
CVE-2026-103936High· 7.5libp2p is a JavaScript implementation of the libp2p networking stack
CVE-2026-110816Medium· 5.3### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ "toStri…
CVE-2026-107392Medium· 6.2music-metadata is a metadata parser for audio and video media files