ag-psd memory exhaustion vulnerability in PSD parsing: upgrade to 31.0.0

GitHub Advisories published GHSA-qfx6-q44v-9qqw for ag-psd, a Node.js library used to read and process Adobe Photoshop PSD files. The vulnerability can cause a process to consume excessive memory when parsing PSD data with unusually declared dimensions.

Overview and technical details

In readPsd(), the library allocates image and layer buffers based on dimensions, channel count, and color depth in the PSD header and layer rectangles before validating those values against the actual data. The advisory states that a 52-byte PSD can make ag-psd 30.2.0 on Node 24 commit about 3.17 GB of memory in about 0.45 seconds and then raise a RangeError; in practice, the process may be OOM-killed before the error is handled.

Affected systems

The stated risk applies to services reading untrusted PSD files: a crafted file can cause remote DoS. Concurrent requests can exhaust memory.

System checks

1. Check the ag-psd version installed in the Node.js project:

   Copy commands

   npm ls ag-psd

2. Alternatively, check the package version directly:

   Copy commands

   node -p "require('ag-psd/package.json').version"

3. Version 31.0.0 or later is fixed; versions below 31.0.0 need upgrading.

Remediation and mitigation

1. Upgrade the npm ag-psd package to version 31.0.0.

2. Until upgraded, avoid processing untrusted PSD files.

3. After upgrading, run one of the version checks above and confirm the version is 31.0.0 or later.

The proposed remediation is to validate declared dimensions, channel count, color depth, and each layer rectangle against the input data length, and to apply reasonable maximum limits before allocating memory.

References

• GitHub Advisories: GHSA-qfx6-q44v-9qqw