Threats affecting pkg:npm/ag-psd

CVE-2026-62297 is a high-severity vulnerability in the ag-psd JavaScript library used for reading and writing Photoshop Document files. Prior to version 31.0.0, the readPsd() function allocates memory buffers based on attacker-controlled PSD geometry declarations without sufficient validation, potentially causing excessive memory allocation. This can lead to denial of service by exhausting system memory or crashing the process. Version 31.0.0 introduces a composite-image allocation limit to mitigate this issue, though some allocation paths may still require review.