GitHub Advisoryadvisory · npm

GHSA-q9xm-f36c-xm3q @steipete/summarize is Vulnerable to Disk Exhaustion via Crafted Media Responses

MEDIUM Published 2026-06-11 Modified 2026-07-27 Official page ↗
Aliases
CVE-2026-53781
Ecosystem
npm
Packages
@steipete/summarize-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weaknesses
CWE-770
Reviewed
2026-07-27

Affected packages

• npm @steipete/summarize-core: < 0.17.0 → fixed in 0.17.0

Description

Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhaustion by serving media responses that bypass the enforced size limit through missing or misreported Content-Length headers, chunked transfer encoding, or failed HEAD requests. Attackers who control a podcast feed or media URL can stream an unbounded response to local storage via the temp-file download path, exhausting disk or system resources on the host running the CLI.

Related

Alias · CVE (1)

  • CVE-2026-53781 Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhaustion by serving media… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References