CVE-2026-53496: ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass at

Executive brief

ExifReader is a library used by applications to extract metadata from image files. A vulnerability in how it handles HEIC and AVIF images allows an attacker to provide a specially crafted image that causes the application to crash. This can lead to a denial-of-service, potentially disrupting image processing workflows or taking down web services that handle user uploads.

Technical details

ExifReader (up to version 4.40.0) contains an uncaught RangeError in its ISO-BMFF parser used for HEIC and AVIF files. The root cause is a lack of bounds checking in `src/image-header-iso-bmff.js` within the `findMetaBox`, `parseBox`, and `getBoxLength` functions. Specifically, the parser unconditionally reads fields (such as the full-box version byte or 64-bit extended size) without verifying that the DataView buffer contains sufficient bytes. An attacker can trigger this by providing a truncated or malformed ISO-BMFF box following a valid `ftyp` box, leading to an unhandled exception that can crash the Node.js process or worker thread. This is fixed in version 4.40.1.

Affected products

• mattiasw exifreader <= 4.40.0

Timeline

• 2026-06-06: disclosed: Vulnerability reported to vendor
• 2026-07-17: advisory: GitHub Advisory published
• 2026-07-17: patched: Version 4.40.1 released

References

• https://api.github.com/users/YHalo-wyh
• https://github.com/YHalo-wyh
• https://api.github.com/users/YHalo-wyh/gists%7B/gist_id%7D
• https://api.github.com/users/YHalo-wyh/repos
• https://avatars.githubusercontent.com/u/206865908?v=4
• https://api.github.com/users/YHalo-wyh/events%7B/privacy%7D