GitHub Advisoryadvisory · npm

GHSA-vpq5-4rc8-c222 Denial of Service in canvas

MEDIUM Published 2019-06-05 Modified 2020-08-31 Official page ↗

Ecosystem: npm
Packages: canvas
Severity: Moderate
Reviewed: 2019-06-05

Affected packages

• npm canvas: < 1.6.10 → fixed in 1.6.10

Description

Versions of `canvas` prior to 1.6.10 are vulnerable to Denial of Service. Processing malicious JPEGs or GIFs could crash the node process. Recommendation Upgrade to version 1.6.10

References

https://github.com/Automattic/node-canvas/commit/c3e4ccb1c404da01e83fe5eb3626bf55f7f55957 web
https://hackerone.com/reports/315037 web
https://www.npmjs.com/advisories/804 web