GHSA-vpq5-4rc8-c222
Denial of Service in canvas
Versions of canvas prior to 1.6.10 are vulnerable to Denial of Service. Processing malicious JPEGs or GIFs could crash the node process.
Recommendation
Upgrade to version 1.6.10
What each source reports
GitHub AdvisoriesNo score
Denial of Service in canvas
Versions of canvas prior to 1.6.10 are vulnerable to Denial of Service. Processing malicious JPEGs or GIFs could crash the node process.
Recommendation
Upgrade to version 1.6.10
- Record
GHSA-vpq5-4rc8-c222- Updated
- 2026-11-02
OSVNo score
Denial of Service in canvas
Versions of canvas prior to 1.6.10 are vulnerable to Denial of Service. Processing malicious JPEGs or GIFs could crash the node process.
Recommendation
Upgrade to version 1.6.10
- Record
GHSA-vpq5-4rc8-c222- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
canvasnpm | before 1.6.10 | 1.6.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-vpq5-4rc8-c222 is a vulnerability with no CVSS score yet in canvas, published June 5, 2019. No source lists public exploit code. Fixed in canvas 1.6.10.