Packages / canvas / Security

ModerateVulnerabilityGHSA-vpq5-4rc8-c222Published 5 Jun 2019

Denial of Service in canvas

Affected releases · canvas

  • 1.x1.0.0 – 1.6.9Fixed in 1.6.10
  • 0.13.x and older0.0.1 – 0.13.1No fix, no longer updated

On 1.x, the newest line:

npm install canvas@1.6.10
3.x

  1. Not affected

    3.0.0 – 3.2.3

    9 releases, latest

1.x

  1. Affected

    1.0.0 – 1.6.9

    53 releases

  2. Fixed

    1.6.10 – 1.6.13

    4 releases

0.x

  1. Affected

    0.0.1 – 0.13.1

    46 releases

135 stable releases of canvas, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for canvas. It is read in your browser and sent nowhere.

What happens

Versions of canvas prior to 1.6.10 are vulnerable to Denial of Service. Processing malicious JPEGs or GIFs could crash the node process.

Recommendation

Upgrade to version 1.6.10