GHSA-2944-57xv-2682 @asymmetric-effort/specifyjs: `data:` URI allowed without size restriction
An attacker can cause memory exhaustion and denial of service by providing excessively large data URIs to the secure-fetch function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-2944-57xv-2682?
GHSA-2944-57xv-2682 is a denial of service vulnerability in @asymmetric-effort/specifyjs, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Finding
Location: core/src/shared/secure-fetch.ts:33-35
data: URIs were allowed without any restriction. While data: URIs don't make network requests, they can be used for memory exhaustion via very large data URIs.
Status
Fixed in v0.2.136 — data: URIs are now limited to 1MB. URIs exceeding this limit throw an error.
Which versions are affected by GHSA-2944-57xv-2682?
2 open source packages ship an affected version, including @asymmetric-effort/specifyjs.
| Package | Affected | Fixed in |
|---|---|---|
@asymmetric-effort/specifyjs npm | All versions | 0.2.136 |
@asymmetric-effort/specifyjs npm | All versions | 0.2.136 |
How do I fix GHSA-2944-57xv-2682?
Upgrade @asymmetric-effort/specifyjs to 0.2.136 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-2944-57xv-2682 being exploited?
There is no known exploitation of GHSA-2944-57xv-2682 in the wild and no public exploit code.