CVE-2020-8175: Uncontrolled resource consumption in jpeg-js
Summary
CVE-2020-8175: Uncontrolled resource consumption in jpeg-js. Affects jpeg-js versions < 0.4.0. Fixed in 0.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jpeg-js package is an npm package that provides a JavaScript implementation of a JPEG encoder and decoder. It allows developers to work with JPEG images in JavaScript applications. The package is widely used in various projects and provides functionality for encoding and decoding JPEG images.
Vulnerability Detail
The vulnerability in jpeg-js before version 0.4.0 allows for uncontrolled resource consumption. An attacker can exploit this vulnerability by providing a specially crafted JPEG image, which can lead to denial of service attacks. The issue arises due to improper handling of resources within the package. If an application using jpeg-js processes a malicious JPEG image, it can cause excessive resource consumption, potentially leading to the application becoming unresponsive or crashing.
How To Fix
Latest published version: 0.4.4 as of 23 Oct 2026
npm install jpeg-js@0.4.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.0
This is the first release that contains the fix.
npm install jpeg-js@0.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the jpeg-js package to mitigate the risk of denial of service attacks.
Conclusion
The jpeg-js package before version 0.4.0 is vulnerable to uncontrolled resource consumption, which can be exploited to launch denial of service attacks. It is crucial to update to version 0.4.0 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jpeg-js →
FAQ
This vulnerability can be exploited by an attacker to launch denial of service attacks on applications using the jpeg-js package. It can lead to excessive resource consumption, potentially causing the application to become unresponsive or crash.
No, only versions before 0.4.0 of the jpeg-js package are affected by this vulnerability. It is recommended to update to version 0.4.0 or later to fix the issue.
No, there is no known workaround for this vulnerability. Updating to the fixed version of the jpeg-js package is the recommended solution.
Yes, this vulnerability can be exploited remotely by providing a specially crafted JPEG image to an application using the jpeg-js package.
There is no evidence of this vulnerability being actively exploited at the moment. However, it is still important to update to the fixed version of the jpeg-js package to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for jpeg-js.
