AIKIDO-2026-786758
ag-psd is vulnerable to Allocation of Resources Without Limits or Throttling
75
CVE Score
High
Allocation of Resources Without Limits or Throttling
TL;DR
Before the fix, readPsd accepted a totalMemoryLimit option to cap memory when parsing untrusted PSD files, but the layer decoding path in decodeLayerImageData read a differently named memoryLimit property, so the cap arrived as undefined and the size check inside createImageDataBitDepth never fired. Anyone who can submit a PSD to an application that parses it with ag-psd could use crafted layer dimensions to trigger allocations far above the configured limit and exhaust process memory (denial of service). The fix forwards totalMemoryLimit through layer, mask and real-mask decoding so the allocation guard is enforced again.
How do I fix this?
Upgrade the ag-psd package to 31.0.1 or later.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and parse PSD files supplied by remote clients with readPsd, decoding layer image data instead of using useRawData.
Package
Versions
0.0.1 - 31.0.0
Fixed in 31.0.1Background info
ag-psd is vulnerable to Allocation of Resources Without Limits or Throttling in versions 0.0.1 - 31.0.0.
Links
GitHub Release
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.