probe-image-size: ReDoS-style SVG Parsing Flaw Enables CPU-based Denial of Service

What happened

probe-image-size's SVG parsing code, found in lib/parse_sync/svg.js and lib/parse_stream/svg.js, uses a regular expression (/<[-_.:a-zA-Z0-9][^>]*>/) to scan SVG markup. When the input contains many '<' characters without a matching closing '>', this regular expression repeatedly scans to the end of the input, resulting in disproportionately high processing time relative to input size.

Technical cause

The synchronous parser (probe.sync()) converts and scans the entire supplied buffer without any cap on input size. The streaming parser, used by probe(stream) and probe(url), is affected differently but similarly: it reparses the full accumulated SVG prefix on every received chunk, meaning that an attacker who controls how data is chunked can further amplify processing cost. Both code paths can drive CPU usage to 100% and block the Node.js event loop while the vulnerable code runs. This is classified as CWE-400 (Uncontrolled Resource Consumption).

Why it matters

Because probe.sync(), probe(stream), and probe(url) are all affected, any application that processes SVG input from an untrusted source through probe-image-size is exposed. A single malicious SVG payload can stall event loop processing for the entire Node.js process, affecting all requests being served, not just the one containing the malicious input.

Who is affected

Any application or service using probe-image-size to inspect SVG files from sources that are not fully trusted (e.g., user uploads, remote URLs) is potentially affected. The vulnerability applies to both the synchronous and streaming parsing entry points.

Affected versions

All versions of probe-image-size from the initial release up to and including 7.3.0 are affected. Version 7.4.0 contains the fix.

Fixes and mitigation

The vendor has released version 7.4.0, which resolves this issue. Users should upgrade from any version up to and including 7.3.0 to 7.4.0.

Recommended action

Upgrade probe-image-size to version 7.4.0 as soon as possible, particularly in applications that process SVG files originating from untrusted or external sources. Until the upgrade is applied, consider limiting or sanitizing SVG input sizes and sources as a temporary mitigation.