Package vulnerability, severity critical

github.com/imgproxy/imgproxy/v3, github.com/imgproxy/imgproxy/v2 and 1 more: imgproxy has integer overflow in imgproxy ICO loader that causes denial of service…

Published October 30, 2026, updated October 31, 2026

imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution. Source: GHSA-hff9-5pqw-6w9f.

What's affected

• github.com/imgproxy/imgproxy/v3 (go)>=4.0.0 <4.0.16
• github.com/imgproxy/imgproxy/v2 (go)>=4.0.0 <4.0.16
• github.com/imgproxy/imgproxy (go)>=4.0.0 <4.0.16

What to do

1. Upgrade github.com/imgproxy/imgproxy/v3 to 4.0.16 or later.
2. Upgrade github.com/imgproxy/imgproxy/v2 to 4.0.16 or later.
3. Upgrade github.com/imgproxy/imgproxy to 4.0.16 or later.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident ghsa-hff9-5pqw-6w9f

References

• https://osv.dev/vulnerability/GHSA-hff9-5pqw-6w9f
• https://github.com/imgproxy/imgproxy/security/advisories/GHSA-hff9-5pqw-6w9f
• https://github.com/imgproxy/imgproxy/commit/a821b6a4cb07a1bf2bb9077431d1c1e734d79917
• https://github.com/imgproxy/imgproxy
• https://github.com/imgproxy/imgproxy/releases/tag/v4.0.16

Notice ghsa-hff9-5pqw-6w9f, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.