ExifReader vulnerabilities
CVEs whose affected-version data names the ExifReader package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-85715High· 7.5PoCExifReader is a JavaScript Exif information parser
ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems() within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount value…
▾ Midnightmattiasw · ExifReaderEPSS 0.41%via NVD
CVE-2026-53496Medium· 5.3PoCExifReader is a JavaScript Exif information parser
ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where f…
▾ Twilightmattiasw · ExifReaderEPSS 0.45%via NVD