Excessive decompression of PNG zTXt metadata in exifreader allows an attacker to trigger an unbounded allocation of memory. A crafted PNG file containing a highly compressed zTXt chunk can cause the library to materialize a Comment value that is orders of magnitude larger than expected, exhausting host memory and potentially leading to a process crash or unresponsiveness. The flaw is classified as CWE‑409 and primarily impacts application availability.

All releases of the exifreader NPM package older than version 4.39.0 are affected. No other vendor or product names are listed in the CNA data.

The CVSS score of 6.9 denotes a high severity availability impact. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is straightforward: an attacker submits a malicious PNG file to any application that uses exifreader with asynchronous parsing enabled. No authentication or privilege escalation is required; any user able to provide the image can trigger the denial‑of‑service.