CVE-2026-8814: ExifReader DoS Vulnerability

CVE-2026-8814 Overview

CVE-2026-8814 affects versions of the exifreader npm package before 4.39.0. The library improperly handles highly compressed PNG zTXt metadata chunks because it lacks a built-in cap on decompressed output size. When asynchronous parsing is enabled, a crafted PNG containing a compressed zTXt chunk causes ExifReader to materialize a disproportionately large Comment value in memory. The flaw is tracked as a Data Amplification weakness under [CWE-409]. Attackers can exploit this remotely via crafted image input to applications that parse user-supplied images with ExifReader, resulting in excessive memory consumption and denial of service conditions.

Critical Impact
Remote attackers can submit small crafted PNG files that decompress into very large in-memory Comment values, leading to memory exhaustion in Node.js or browser-based applications using vulnerable ExifReader versions.

Affected Products

exifreader npm package versions prior to 4.39.0
Node.js applications performing asynchronous PNG metadata parsing with ExifReader
Browser-based applications bundling vulnerable ExifReader releases

Discovery Timeline

2026-05-19 - CVE-2026-8814 published to NVD
2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-8814

Vulnerability Analysis

The vulnerability resides in ExifReader's PNG metadata parser. PNG zTXt chunks carry textual metadata compressed with zlib deflate. ExifReader decompresses these chunks during asynchronous parsing and stores the result as the Comment value on the returned tags object. The library does not enforce a maximum decompressed output size before allocating memory for the result.

Deflate compression supports ratios exceeding 1000:1 against repetitive byte patterns. An attacker can craft a zTXt chunk a few kilobytes in size that expands to hundreds of megabytes or gigabytes when decompressed. The parser blindly materializes this output as a JavaScript string, which forces the runtime to allocate the full decompressed buffer.

Root Cause

The DecompressOptions type used by ExifReader's PNG handler accepted brotli and deflate decompression functions but did not expose a parameter to bound output size. The decompression callbacks therefore ran to completion regardless of how large the output became.

Attack Vector

Exploitation requires the target application to invoke ExifReader's asynchronous parser on attacker-controlled PNG data. Common scenarios include image upload endpoints, avatar processing pipelines, and client-side EXIF previews. The attacker submits a PNG containing a malicious zTXt chunk. ExifReader decompresses the chunk, allocates a large Comment string, and exhausts process memory. No authentication or user interaction is required beyond the normal image submission flow.

typescript

 type DecompressOptions = {
     brotli?: DecompressFunction,
     deflate?: DecompressFunction,
+    maxDecompressedSize?: number,
 };
 
 type CommonOptions = {
// Source: https://github.com/mattiasw/ExifReader/commit/5f116128adc19f674902f8bf582bfe7dd0a36375
// The patch adds a maxDecompressedSize option to DecompressOptions, allowing
// callers to cap the size of decompressed metadata blocks and abort processing
// when a zTXt chunk would expand beyond the configured threshold.

Detection Methods for CVE-2026-8814

Indicators of Compromise

Node.js processes terminating with JavaScript heap out of memory errors shortly after image uploads
Sustained memory growth in services that call ExifReader.load() or ExifReader.loadAsync() on user-supplied PNG files
Inbound PNG files containing unusually small zTXt chunks that decompress to multi-megabyte payloads

Detection Strategies

Inventory application dependencies and flag any exifreader package version below 4.39.0 via npm ls exifreader or software composition analysis tooling.
Inspect uploaded PNG files for zTXt chunks and compute their compression ratio. Flag ratios above a conservative threshold such as 100:1.
Correlate image upload events with process restart logs and out-of-memory kernel messages to identify exploitation attempts.

Monitoring Recommendations

Track per-request memory allocation on endpoints that parse image metadata and alert on outliers.
Log image MIME type, file size, and parser duration to surface anomalously slow PNG parsing operations.
Monitor container restart counts and OOM-kill events on services that handle user-supplied images.

How to Mitigate CVE-2026-8814

Immediate Actions Required

Upgrade exifreader to version 4.39.0 or later in all production and build manifests.
Pass an explicit maxDecompressedSize option to ExifReader's async API to bound zTXt expansion.
Enforce upload size limits and reject PNG files whose declared chunk sizes exceed business requirements.

Patch Information

The maintainer addressed the issue in commit 5f11612 by extending DecompressOptions with a maxDecompressedSize parameter. ExifReader 4.39.0 ships this fix. Refer to the GitHub commit and the Snyk advisory for the full patch details.

Workarounds

Disable asynchronous PNG parsing in code paths that accept untrusted input until the package is upgraded.
Wrap ExifReader calls in a worker thread with a constrained heap limit so that decompression bombs cannot exhaust the main process memory.
Pre-validate uploaded PNG files by stripping or rejecting zTXt and iTXt chunks before passing data to ExifReader.

bash

# Upgrade exifreader to a patched version
npm install exifreader@^4.39.0

# Run a Node.js worker with a constrained heap as a defense-in-depth measure
node --max-old-space-size=256 image-metadata-worker.js