fix(deps): update dependency exifreader to v4.39.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
exifreader	4.38.1 → 4.39.0

---

ExifReader is vulnerable to denial of service via unbounded decompression of image metadata

CVE-2026-8814 / GHSA-rr89-w3h9-m66j

More information

Details

Impact

Versions of ExifReader from 4.20.0 through 4.38.1 do not bound the size of decompressed metadata blocks. When a caller invokes the asynchronous API (e.g. ExifReader.load(file) or ExifReader.load(buffer, {async: true})) on an attacker-supplied image, a small compressed chunk in the file can expand to hundreds of megabytes of memory, consuming heap and CPU until the process slows down or runs out of memory.

The affected paths share a single decompression utility, so the issue is reachable through any compressed metadata block the library handles asynchronously, including:

• PNG zTXt, compressed iTXt, and iCCP chunks (deflate)
• JPEG XL Brotli-compressed Exif and XMP blocks

A typical proof of concept produced roughly 1000× expansion (for example, ~32 KB of compressed input expanded to ~32 MB of output, ~130 KB to ~128 MB).

Both the npm package and the dist/ bundle published from this repository (consumed by Bower and other users of the prebuilt artifact) are affected.

Patches

Fixed in 4.39.0. The decompression utility now reads the decompressed stream incrementally and aborts as soon as the running total would exceed a configurable limit. The default cap is 128 MiB per metadata block, which is well above any realistic legitimate value. When a block exceeds the cap, that block is skipped (a warning is emitted via console.warn) and the remaining tags are returned as usual.

The cap is configurable via the new maxDecompressedSize field on the decompress option, in bytes:

const tags = await ExifReader.load(file, {
    async: true,
    decompress: {
        maxDecompressedSize: 16 * 1024 * 1024 // 16 MiB
    }
});

The same cap applies to results returned by user-supplied custom brotli/deflate functions.

Workarounds

• If upgrading is not possible, avoid invoking the asynchronous API on untrusted inputs. The synchronous code path skips compressed metadata blocks entirely and is not affected. Alternatively, pre-validate input files by source or size before passing them to ExifReader.

Resources

• Reporter's writeup: https://gist.github.com/yuki-matsuhashi/cad1a45d936062438b4ab24613c34c55
• Patch: mattiasw/ExifReader@5f11612
• README — "Limiting decompressed metadata size": https://github.com/mattiasw/ExifReader/blob/main/README.md#limiting-decompressed-metadata-size

Severity

• CVSS Score: 5.5 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://github.com/mattiasw/ExifReader/security/advisories/GHSA-rr89-w3h9-m66j
• https://nvd.nist.gov/vuln/detail/CVE-2026-8814
• https://github.com/mattiasw/ExifReader/commit/5f116128adc19f674902f8bf582bfe7dd0a36375
• https://gist.github.com/yuki-matsuhashi/cad1a45d936062438b4ab24613c34c55
• https://security.snyk.io/vuln/SNYK-JS-EXIFREADER-16689340
• https://github.com/advisories/GHSA-rr89-w3h9-m66j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

ExifReader is vulnerable to denial of service via crafted ICC mluc tag

CVE-2026-8813 / GHSA-h64w-w9pr-82m4

More information

Details

Impact

When parsing an image with an embedded ICC profile that contains a crafted multiLocalizedUnicodeType (mluc) tag, ExifReader can be made to allocate memory proportional to attacker-controlled fields in the tag rather than to
the actual size of the input. Processing such an image causes excessive memory consumption and can terminate the host process (out-of-memory).

Any application that calls ExifReader.load() on untrusted images, for example, user uploads in a web service, is affected. ICC profiles are carried in JPEG, TIFF, PNG, HEIC, AVIF, JPEG XL, and WebP, so the issue is reachable from any of those formats.

Patches

Fixed in exifreader@4.39.0. Upgrade with:

npm install exifreader@latest

Bower users consume the bundled dist/ files from this repository, and the same fix is committed there.

Workarounds

If upgrading is not immediately possible, configure a custom build that excludes the icc module so that ICC parsing (and therefore this code path) is skipped entirely.

Resources

• Reporter's writeup: https://gist.github.com/yuki-matsuhashi/3243ea38e5fbf8cfe19b624f04c9f4b4
• Patch: mattiasw/ExifReader@c9d88b6

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

References

• https://github.com/mattiasw/ExifReader/security/advisories/GHSA-h64w-w9pr-82m4
• https://nvd.nist.gov/vuln/detail/CVE-2026-8813
• https://github.com/mattiasw/ExifReader/commit/c9d88b67e127b2dcc7b46e328df468257fb2dc30
• https://gist.github.com/yuki-matsuhashi/3243ea38e5fbf8cfe19b624f04c9f4b4
• https://security.snyk.io/vuln/SNYK-JS-EXIFREADER-16689335
• https://github.com/advisories/GHSA-h64w-w9pr-82m4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

mattiasw/ExifReader (exifreader)

v4.39.0

Compare Source

Added

• decompress.maxDecompressedSize option to bound the size of any single
  decompressed metadata block (default 128 MiB). Blocks that would exceed the
  limit are skipped with a console.warn; remaining tags are returned as usual.

Fixed

• Parse UserComment value when encoding is undefined but contains printable text.

Security

• Fix denial-of-service when parsing crafted ICC mluc tags
  (CVE-2026-8813,
  GHSA-h64w-w9pr-82m4).
  Reported by Yuki Matsuhashi (@​yuki-matsuhashi).
• Fix denial-of-service via unbounded decompression of compressed image metadata
  (CVE-2026-8814,
  GHSA-rr89-w3h9-m66j).
  Reported by Yuki Matsuhashi (@​yuki-matsuhashi).

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 15.22%. Comparing base (d74b646) to head (637fc96).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #17510      +/-   ##
===========================================
- Coverage    24.92%   15.22%   -9.71%     
===========================================
  Files         1160      247     -913     
  Lines        39555    12349   -27206     
  Branches     11016     4196    -6820     
===========================================
- Hits          9861     1880    -7981     
+ Misses       23796     8196   -15600     
+ Partials      5898     2273    -3625     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.