---
id: CVE-2026-53496
title: ExifReader is a JavaScript Exif information parser
summary: >-
  ExifReader is a JavaScript Exif information parser. Prior to 4.40.1,
  ExifReader.load() and the asynchronous file and URL loaders can pass
  attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in
  src/image-header-iso-bmff.js, where f…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-248
  - CWE-755
vendor: mattiasw
product: ExifReader
affected:
  - ExifReader < 4.40.1
patched:
  - exifreader 4.40.1
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T19:17:25.107'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53496'
references:
  - url: >-
      https://github.com/mattiasw/ExifReader/commit/00878ca9df0e26480dda7a931c888048c9f7be45
    label: security-advisories@github.com
  - url: 'https://github.com/mattiasw/ExifReader/releases/tag/v4.40.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/mattiasw/ExifReader/security/advisories/GHSA-g77h-45rf-hcx4
    label: security-advisories@github.com
  - url: >-
      https://github.com/mattiasw/ExifReader/security/advisories/GHSA-g77h-45rf-hcx4
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-g77h-45rf-hcx4'
tags:
  - nvd
  - cve.org
  - ghsa
  - npm
  - exploit-available
aliases:
  - GHSA-g77h-45rf-hcx4
ecosystem: npm
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-14T18:51:58.164120Z'
ingestedAt: '2026-07-17T21:16:24.484Z'
epss: 0.00451
epssPercentile: 0.3857
---

## Overview

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox() and parseBox() accept an eight-byte box header without confirming that fields required by the parsed box remain in the DataView. A valid ftyp box followed by an empty free or unknown box can cause an unchecked full-box version read, while a truncated extended-size box can make getBoxLength() and hasEmptyHighBits() read absent size fields. The resulting RangeError escapes the main parsing path and can abort an application request or worker when parse errors are not defensively caught, causing denial of service. This issue is fixed in version 4.40.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-53496)

Affected packages:

- `exifreader <= 4.40.0`

Patched in:

- `exifreader 4.40.1`

Source: https://github.com/advisories/GHSA-g77h-45rf-hcx4