The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never return.
Weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jpeg-js | Jpeg-js_project | * | 0.4.4 (excluding) |
References
- https://github.com/jpeg-js/jpeg-js/commit/9ccd35fb5f55a6c4f1902ac5b0f270f675750c27
- https://github.com/jpeg-js/jpeg-js/issues/105
- https://github.com/jpeg-js/jpeg-js/pull/106/
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2860295
- https://snyk.io/vuln/SNYK-JS-JPEGJS-2859218
- https://github.com/jpeg-js/jpeg-js/commit/9ccd35fb5f55a6c4f1902ac5b0f270f675750c27
- https://github.com/jpeg-js/jpeg-js/issues/105
- https://github.com/jpeg-js/jpeg-js/pull/106/
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2860295
- https://snyk.io/vuln/SNYK-JS-JPEGJS-2859218