GitHub Advisoryadvisory · npm

GHSA-2944-57xv-2682 @asymmetric-effort/specifyjs: `data:` URI allowed without size restriction

MEDIUM Published 2026-07-02 Modified 2026-07-02 Official page ↗
Ecosystem
npm
Packages
@asymmetric-effort/specifyjs
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-918
Reviewed
2026-07-02

Affected packages

• npm @asymmetric-effort/specifyjs: < 0.2.136 → fixed in 0.2.136

Description

Finding Location: `core/src/shared/secure-fetch.ts:33-35` `data:` URIs were allowed without any restriction. While `data:` URIs don't make network requests, they can be used for memory exhaustion via very large data URIs. Status Fixed in v0.2.136 — `data:` URIs are now limited to 1MB. URIs exceeding this limit throw an error.

Related

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References