Summary
@jimp/core@1.6.0 depends on file-type@^16.0.0, which is affected by GHSA-5v7r-6r5c-r473 — an infinite loop in the ASF parser on malformed input with a zero-size sub-header.
The vulnerability affects all file-type versions >=13.0.0 <21.3.1. The fix requires updating to >=21.3.1.
Affected code
In @jimp/core/src/index.ts:
import fileType from "file-type/core.js";
// ...
const mime = await fileType.fromBuffer(actualBuffer);
Required changes
The file-type v21 API replaced the default export with named exports:
- import fileType from "file-type/core.js";
+ import { fileTypeFromBuffer } from "file-type/core.js";
// ...
- const mime = await fileType.fromBuffer(actualBuffer);
+ const mime = await fileTypeFromBuffer(actualBuffer);And update package.json:
- "file-type": "^16.0.0"
+ "file-type": "^21.3.1"
Workaround
Consumers can apply a pnpm patch to @jimp/core and override the dependency:
{
"pnpm": {
"overrides": {
"@jimp/core>file-type": "21.3.1"
}
}
}
Summary
@jimp/core@1.6.0depends onfile-type@^16.0.0, which is affected by GHSA-5v7r-6r5c-r473 — an infinite loop in the ASF parser on malformed input with a zero-size sub-header.The vulnerability affects all
file-typeversions>=13.0.0 <21.3.1. The fix requires updating to>=21.3.1.Affected code
In
@jimp/core/src/index.ts:Required changes
The
file-typev21 API replaced the default export with named exports:And update
package.json:Workaround
Consumers can apply a pnpm patch to
@jimp/coreand override the dependency:{ "pnpm": { "overrides": { "@jimp/core>file-type": "21.3.1" } } }