What is CVE-2026-104861?

CVE-2026-104861 is a high-severity uncontrolled resource consumption vulnerability in probe-image-size (npm), affecting versions <= 7.3.0. It is fixed in 7.4.0. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.

How severe is CVE-2026-104861?

CVE-2026-104861 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Which versions of probe-image-size are affected by CVE-2026-104861?

probe-image-size (npm) versions <= 7.3.0 is affected.

Is there a fix for CVE-2026-104861?

Yes. CVE-2026-104861 is fixed in 7.4.0. Upgrade to this version or later.

Is CVE-2026-104861 exploitable, and should I be worried?

Whether CVE-2026-104861 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-104861 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

CVE-2026-104861 in probe-image-size

Q: How severe is CVE-2026-104861?

CVE-2026-104861 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Q: Which versions of probe-image-size are affected by CVE-2026-104861?

probe-image-size (npm) versions <= 7.3.0 is affected.

Q: Is there a fix for CVE-2026-104861?

Yes. CVE-2026-104861 is fixed in 7.4.0. Upgrade to this version or later.

Q: Is CVE-2026-104861 exploitable, and should I be worried?

Whether CVE-2026-104861 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2026-104861 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2026-104861?

Upgrade probe-image-size to 7.4.0 or later.

Summary

probe-image-size: Quadratic-time Denial of Service in the SVG Parser

Overview

probe-image-size scans the SVG header with a searching regular expression, /<[-_.:a-zA-Z0-9][^>]*>/. On input that contains many < characters but no >, the engine restarts the [^>]* scan at every < position and runs to end of input each time, giving quadratic time complexity.

Both the synchronous and the streaming parser are affected.

Root Cause Analysis

Two independent problems.

Absence of input size cap in the sync path. lib/parse_sync/svg.js copied the entire buffer into a string and matched against it. There was no size limit at all, so cost scaled with the size of the attacker-supplied buffer.
Repeated rescanning in the stream path. lib/parse_stream/svg.js did cap accumulated data at 64 KB, but called parseSvg(str) on the whole accumulated string on every chunk, giving O(chunks × N²). The cap does not help here: the more chunks the input is split into, the more times the quadratic scan is repeated.

Chunk size is influenced by the sender. highWaterMark (16 KB) is a buffering threshold, not a lower bound, a socket read returns whatever has arrived. A server that writes one byte at a time produces one-byte chunks; this was confirmed against the real needle pipeline with default options.

The original report identified (1) only, and stated that the 64 KB cap mitigates the streaming path. It does not.

Proof of Concept (PoC)

Synchronous:

const probe = require('probe-image-size')

// ~200 KB of '<a', contains '<' but never '>'
probe.sync(Buffer.from('<a'.repeat(100000), 'latin1'))

Streaming, the same payload split into chunks, slower per byte than the synchronous form:

const { Readable } = require('stream')
const probe = require('probe-image-size')

const payload = Buffer.from('<a'.repeat(32768), 'latin1')
const chunks = []
for (let i = 0; i < payload.length; i += 4096) chunks.push(payload.subarray(i, i + 4096))

await probe(Readable.from(chunks))

Measurements on the maintainer's machine:

path	input	time
`probe.sync()`	25 KB	0.9 s
`probe.sync()`	50 KB	5.5 s
`probe.sync()`	100 KB	18 s
`probe.sync()`	200 KB	54 s
`probe(stream)`	64 KB, 1 chunk	1.6 s
`probe(stream)`	64 KB, 4 chunks	2.9 s
`probe(stream)`	64 KB, 16 chunks	9.6 s

Impact

Every entry point that reaches the SVG parser is affected: probe.sync(), probe(stream) and probe(url). The URL form is the most exposed one, the input is fetched from a remote host, so an attacker only needs to supply a link.

Processing a crafted buffer blocks the Node.js event loop at 100% CPU for the whole duration. In production environments such as upload validators, image proxies or link unfurl services, a small number of concurrent requests is enough to deny service.

Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.

CVE-2026-104861 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (7.4.0); upgrading removes the vulnerable code path.

Affected versions

probe-image-size (<= 7.3.0)

Security releases

probe-image-size → 7.4.0 (npm)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Upgrade probe-image-size to 7.4.0 or later to resolve this vulnerability.

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is CVE-2026-104861? CVE-2026-104861 is a high-severity uncontrolled resource consumption vulnerability in probe-image-size (npm), affecting versions <= 7.3.0. It is fixed in 7.4.0. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
How severe is CVE-2026-104861? CVE-2026-104861 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
Which versions of probe-image-size are affected by CVE-2026-104861? probe-image-size (npm) versions <= 7.3.0 is affected.
Is there a fix for CVE-2026-104861? Yes. CVE-2026-104861 is fixed in 7.4.0. Upgrade to this version or later.
Is CVE-2026-104861 exploitable, and should I be worried? Whether CVE-2026-104861 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-104861 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-104861? Upgrade probe-image-size to 7.4.0 or later.