CVE-2022-25851: Denial of Service in jpeg-js
Summary
CVE-2022-25851: Infinite loop in jpeg-js. Affects jpeg-js versions < 0.4.4. Fixed in 0.4.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jpeg-js package is an npm package that provides functionality for encoding and decoding JPEG images in JavaScript. It is widely used in web applications and other projects that require image processing. However, versions before 0.4.4 of jpeg-js are vulnerable to a Denial of Service (DoS) attack. This vulnerability allows an attacker to cause the program to enter an infinite loop and never return, leading to a complete system freeze or unresponsiveness.
Vulnerability Detail
The vulnerability in jpeg-js arises from a flaw in the handling of certain input. When a specific piece of input is provided, the program enters an infinite loop, causing the system to become unresponsive. This can be exploited by an attacker to launch a DoS attack, disrupting the normal operation of the affected application or system. The severity of this vulnerability is rated as HIGH, with a CVSS score of 7.5.
How To Fix
Latest published version: 0.4.4 as of 23 Oct 2026
npm install jpeg-js@0.4.4The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the jpeg-js package to the fixed version to mitigate the risk of a DoS attack.
Conclusion
The jpeg-js package before version 0.4.4 is vulnerable to a Denial of Service (DoS) attack. It is crucial to update the package to the fixed version to mitigate the risk of system freeze or unresponsiveness. Promptly applying the security patch ensures the protection of the affected application or system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jpeg-js →
FAQ
The vulnerability allows an attacker to launch a DoS attack, causing the affected system or application to become unresponsive or freeze. This can lead to service disruption and potential loss of data.
At the time of this advisory, there is no known public exploit for this vulnerability. However, it is always recommended to apply security patches promptly to mitigate the risk.
Yes, this vulnerability can be exploited remotely. An attacker can send specially crafted input to the affected application or system, triggering the infinite loop and causing a DoS condition.
No, only versions before 0.4.4 of jpeg-js are affected by this vulnerability. It is crucial to update to version 0.4.4 or later to address the issue.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for jpeg-js.
