Vulnerability · Published Jun 10, 2022 · Assigned by snyk
CVE-2022-25851Denial of Service (DoS)
High 7.5
In plain English
A high-severity security flaw in jpeg-js. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.9%top 20.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never return.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | jpeg-js | 0.4.4 | GHSA-xvf7-4v9q-58w6 |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-JS-JPEGJS-2859218 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2860295 x_refsource_MISC
- https://github.com/jpeg-js/jpeg-js/issues/105 x_refsource_MISC
- https://github.com/jpeg-js/jpeg-js/pull/106/ x_refsource_MISC
- https://github.com/jpeg-js/jpeg-js/commit/9ccd35fb5f55a6c4f1902ac5b0f270f675750c27 x_refsource_MISC