# @asymmetric-effort/specifyjs unrestricted data URI memory exhaustion

Source: https://junglewise.ai/threats/asymmetric-effort-specifyjs-unrestricted-data-uri-memory-exhaustion-47844f22  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4 · Published 2026-07-02

SpecifyJS is a TypeScript UI framework that includes a secure-fetch module for handling network requests. An attacker can cause memory exhaustion and application crash by submitting extremely large data: URIs without size restrictions. This can be exploited to disable the application or degrade performance for legitimate users. The fix in v0.2.136 enforces a 1MB limit on data: URIs and throws an error for oversized URIs.

Technologies: [Asymmetric Effort Specifyjs](https://junglewise.ai/threats/technologies/specifyjs), [@asymmetric-effort/specifyjs (npm)](https://junglewise.ai/threats/technologies/asymmetric-effort-specifyjs). Vendors: [Asymmetric Effort](https://junglewise.ai/threats/vendors/asymmetric-effort), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4, published 2 July 2026.

**Which products and versions are affected?** Asymmetric Effort Specifyjs < 0.2.136; @asymmetric-effort/specifyjs (npm) SEMVER:introduced=0,fixed=0.2.136.

**Is there a fix for This vulnerability?** Yes. @asymmetric-effort/specifyjs (npm): upgrade to 0.2.136 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Asymmetric Effort Specifyjs or @asymmetric-effort/specifyjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @asymmetric-effort/specifyjs (npm): upgrade to 0.2.136 or later

  ```sh
  npm install @asymmetric-effort/specifyjs@0.2.136
  ```


## Technical details

The vulnerability exists in core/src/shared/secure-fetch.ts (lines 33-35) where data: URIs are accepted without any size validation. While data: URIs do not trigger outbound network requests (mitigating traditional SSRF concerns), they can be exploited for memory exhaustion attacks when arbitrarily large payloads are embedded. The attack vector is network-based with no authentication required. An attacker can craft requests with massive data: URIs to exhaust the server or client's available memory, causing denial of service. The vulnerability is classified under CWE-918 (Server-Side Request Forgery) due to the URI handling context. A patch was released in v0.2.136 that enforces a 1MB maximum size limit and throws an error when the limit is exceeded.

## Affected products

- @asymmetric-effort specifyjs < 0.2.136

## Timeline

- 2026-05-29: disclosed: Vulnerability discovered during penetration testing
- 2026-05-29: patched: Fixed in v0.2.136 with 1MB data: URI size limit
- 2026-07-02: advisory: GHSA-2944-57xv-2682 published

## References

- [https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-2944-57xv-2682](https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-2944-57xv-2682)
- [https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a](https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a)
- [https://github.com/asymmetric-effort/specifyjs](https://github.com/asymmetric-effort/specifyjs)

## Related threats

- [Asymmetric Effort SpecifyJS CSS sanitization bypass in renderToString](https://junglewise.ai/threats/cve-2026-50290-asymmetric-effort-specifyjs-css-sanitization-bypass-in)
- [SpecifyJS SSRF via URL validation bypass in secure-fetch](https://junglewise.ai/threats/cve-2026-50288-specifyjs-ssrf-via-url-validation-bypass-in-secure-fetch)
- [@asymmetric-effort/specifyjs redirect SSRF in secureFetch](https://junglewise.ai/threats/asymmetric-effort-specifyjs-redirect-ssrf-in-securefetch-09dbb315)
- [@asymmetric-effort/specifyjs localhost bypass in SSRF check](https://junglewise.ai/threats/asymmetric-effort-specifyjs-localhost-bypass-in-ssrf-check-63583c44)
- [@asymmetric-effort/specifyjs information disclosure via console warnings](https://junglewise.ai/threats/asymmetric-effort-specifyjs-information-disclosure-via-console-warnings-1afedf35)