GHSA-gjj5-9665-rwrc

## Overview

`probe-image-size` scans the SVG header with a searching regular expression, `/<[-_.:a-zA-Z0-9][^>]*>/`. On input that contains many `<` characters but no `>`, the engine restarts the `[^>]*` scan at every `<` position and runs to end of input each time, giving quadratic time complexity.

Both the synchronous and the streaming parser are affected.

## Impact

Every entry point that reaches the SVG parser is affected: `probe.sync()`, `probe(stream)` and `probe(url)`. The URL form is the most exposed one — the input is fetched from a remote host, so an attacker only needs to supply a link.

Processing a crafted buffer blocks the Node.js event loop at 100% CPU for the whole duration. In production environments such as upload validators, image proxies or link unfurl services, a small number of concurrent requests is enough to deny service.

## Root Cause Analysis

Two independent problems.

1. **Absence of input size cap in the sync path.** `lib/parse_sync/svg.js` copied the entire buffer into a string and matched against it. There was no size limit at all, so cost scaled with the size of the attacker-supplied buffer.

2. **Repeated rescanning in the stream path.** `lib/parse_stream/svg.js` did cap accumulated data at 64 KB, but called `parseSvg(str)` on the whole accumulated string on *every* chunk, giving `O(chunks × N²)`. The cap does not help here: the more chunks the input is split into, the more times the quadratic scan is repeated.

Chunk size is influenced by the sender. `highWaterMark` (16 KB) is a buffering threshold, not a lower bound — a socket read returns whatever has arrived. A server that writes one byte at a time produces one-byte chunks; this was confirmed against the real `needle` pipeline with default options.

The original report identified (1) only, and stated that the 64 KB cap mitigates the streaming path. It does not.

## Proof of Concept (PoC)

Synchronous:

```js const probe = require('probe-image-size')

// ~200 KB of '<a' — contains '<' but never '>' probe.sync(Buffer.from('<a'.repeat(100000), 'latin1')) ```

Streaming — the same payload split into chunks, slower per byte than the synchronous form:

```js const { Readable } = require('stream') const probe = require('probe-image-size')

const payload = Buffer.from('<a'.repeat(32768), 'latin1') const chunks = [] for (let i = 0; i < payload.length; i += 4096) chunks.push(payload.subarray(i, i + 4096))

await probe(Readable.from(chunks)) ```

Measurements on the maintainer's machine:

| path | input | time | | --- | --- | --- | | `probe.sync()` | 25 KB | 0.9 s | | `probe.sync()` | 50 KB | 5.5 s | | `probe.sync()` | 100 KB | 18 s | | `probe.sync()` | 200 KB | 54 s | | `probe(stream)` | 64 KB, 1 chunk | 1.6 s | | `probe(stream)` | 64 KB, 4 chunks | 2.9 s | | `probe(stream)` | 64 KB, 16 chunks | 9.6 s |