Executive brief
The node-images library is a popular Node.js package for image manipulation. A vulnerability allows attackers to crash applications using this library by passing unexpected data types to image processing functions. This could disrupt services that rely on image processing, causing temporary unavailability.
Technical details
The vulnerability is an improper input validation issue (CWE-241, CWE-400) in the node-images native C++ bindings. Multiple functions including New(), SetWidth(), SetHeight(), Resize(), Rotate(), FillColor(), and size() lack proper type checking and validation. By passing object types instead of expected integers, or specific integer values like 0 to the size() function, an attacker can trigger unhandled assert macros and segmentation faults. The attack requires only ability to call the library functions, typically local or through application input processing. A successful exploit crashes the Node.js process, causing denial of service.
Affected products
- node-images images all versions through 3.2.4
Timeline
- 2024-01-15: disclosed: Vulnerability reported on GitHub Gist
- 2024-07-10: advisory: GHSA advisory published