Threats tagged 'ghsa-w3rx-r6r6-pgpr'

image-size versions up to 2.0.2 contain a denial of service vulnerability in the ICNS parser. A specially crafted ICNS image buffer with valid magic bytes and a zero-valued entry length can cause an infinite loop, blocking the Node.js event loop indefinitely. This vulnerability can be triggered remotely without authentication.