probe‑image‑size uses a regular expression that scans a given SVG string to locate image tags. When the input contains many unclosed < characters, the regex repeatedly scans to the end of the buffer, causing a worst‑case quadratic execution time. Attackers can supply such payloads to the probe.sync(), probe(stream), or probe(url) functions, causing the Node.js event loop to block entirely and preventing the application from servicing requests. The vulnerability is a classic denial‑of‑service flaw associated with the CWE identifiers for non‑controlled memory consumption and denial of service. The library’s synchronous parser is particularly vulnerable because it processes the entire buffer at once, while the streaming parser reparses the accumulated data for each chunk, an effect that can be amplified if the attacker chunks the payload in a specific pattern.

The nodeca probe‑image‑size library, versions prior to the 7.4.0 release, are affected. Users of the 7.4.0 or later releases have applied the remediation commit that eliminates the inefficient regular expression. Any applications that depend on the library must verify the exact version used, and the vulnerability is present in all earlier releases.

(Note: because no EPSS score is available, the actual exploitation likelihood cannot be quantified. The high CVSS score suggests that the flaw is significant if the library is used with untrusted input.)