Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 2 July 2026.

Which products and versions are affected?

Asymmetric Effort Specifyjs < 0.2.136; @asymmetric-effort/specifyjs (npm) SEMVER:introduced=0,fixed=0.2.136.

Is there a fix for This vulnerability?

Yes. @asymmetric-effort/specifyjs (npm): upgrade to 0.2.136 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Asymmetric Effort Specifyjs or @asymmetric-effort/specifyjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

@asymmetric-effort/specifyjs unrestricted data URI memory exhaustion

Q: Is there a fix for This vulnerability?

Yes. @asymmetric-effort/specifyjs (npm): upgrade to 0.2.136 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run Asymmetric Effort Specifyjs or @asymmetric-effort/specifyjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 4 · Published 2026-07-02

SpecifyJS is a TypeScript UI framework that includes a secure-fetch module for handling network requests. An attacker can cause memory exhaustion and application crash by submitting extremely large data: URIs without size restrictions. This can be exploited to disable the application or degrade performance for legitimate users. The fix in v0.2.136 enforces a 1MB limit on data: URIs and throws an error for oversized URIs.

Technologies: Asymmetric Effort Specifyjs, @asymmetric-effort/specifyjs (npm). Vendors: Asymmetric Effort, npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 2 July 2026.
Which products and versions are affected?: Asymmetric Effort Specifyjs < 0.2.136; @asymmetric-effort/specifyjs (npm) SEMVER:introduced=0,fixed=0.2.136.
Is there a fix for This vulnerability?: Yes. @asymmetric-effort/specifyjs (npm): upgrade to 0.2.136 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Asymmetric Effort Specifyjs or @asymmetric-effort/specifyjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@asymmetric-effort/specifyjs (npm): upgrade to 0.2.136 or later
```
npm install @asymmetric-effort/specifyjs@0.2.136
```

Technical details

The vulnerability exists in core/src/shared/secure-fetch.ts (lines 33-35) where data: URIs are accepted without any size validation. While data: URIs do not trigger outbound network requests (mitigating traditional SSRF concerns), they can be exploited for memory exhaustion attacks when arbitrarily large payloads are embedded. The attack vector is network-based with no authentication required. An attacker can craft requests with massive data: URIs to exhaust the server or client's available memory, causing denial of service. The vulnerability is classified under CWE-918 (Server-Side Request Forgery) due to the URI handling context. A patch was released in v0.2.136 that enforces a 1MB maximum size limit and throws an error when the limit is exceeded.

Affected products

@asymmetric-effort specifyjs < 0.2.136

Timeline

2026-05-29: disclosed: Vulnerability discovered during penetration testing
2026-05-29: patched: Fixed in v0.2.136 with 1MB data: URI size limit
2026-07-02: advisory: GHSA-2944-57xv-2682 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.