Executive brief
jpeg-js is a JavaScript library used to decode JPEG images in web and Node.js applications. An attacker can craft a malicious JPEG file that forces the decoder to consume excessive memory or processing time, causing the application to become unresponsive or crash (denial of service). This could disrupt services that process user-uploaded images without proper validation.
Technical details
jpeg-js versions before 0.4.0 lack resource limits when decoding JPEG images, allowing an attacker to provide a specially crafted JPEG that triggers uncontrolled memory allocation and processing (CWE-400). The vulnerability requires user interaction (an attacker must trick a user or application into processing the malicious image). The local attack vector indicates the file must be provided to the vulnerable application rather than exploited remotely. Exploitation causes denial of service through memory exhaustion or CPU starvation. The fix, released in version 0.4.0, adds configurable memory and resolution limits (maxMemoryInMB and maxResolutionInMP parameters) that prevent decoding of oversized images.
Affected products
- jpeg-js jpeg-js before 0.4.0
Timeline
- 2020-07-27: disclosed
- 2020-04-23: patched: Fix committed to repository (version 0.4.0)