Quick answers
- Is CVE-2025-67419 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-67419 being exploited in the wild.
- How severe is CVE-2025-67419?
- High severity, with a CVSS score of 7.5, published 5 January 2026.
- Which products and versions are affected?
- EverShop 2.1.0 and prior; @evershop/evershop (npm) SEMVER:introduced=0,last_affected=2.1.0.
- Is there a fix for CVE-2025-67419?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-67419 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2025-67419?
- Check whether you run EverShop or @evershop/evershop (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Denial of Service vulnerability in the GET /images API endpoint fails to enforce limits on SVG element shadow tree height or pattern tile dimensions during file processing. The vulnerability is reachable without authentication, allowing an unauthenticated attacker to submit maliciously crafted SVG files that trigger unbounded memory or CPU consumption. This results in exhaustion of application server resources and denial of service. The vulnerability affects EverShop versions 2.1.0 and earlier with no identified upstream patch yet available.
Affected products
- EverShop EverShop 2.1.0 and prior
Identifiers
- CVE-2025-67419
- GHSA-m2q5-xhqg-92r2
Timeline
- 2026-01-05: disclosed: GHSA advisory published
- 2026-01-05: other: CVE-2025-67419 assigned