---
license: mit
tags:
  - security
  - proof-of-concept
  - tensorflow-js
  - denial-of-service
---

# TensorFlow.js weights-manifest shape DoS PoC

This repository contains a proof-of-concept malicious `.tfjs`-style weights manifest for a
responsibly-disclosed vulnerability in [`tensorflow/tfjs`](https://github.com/tensorflow/tfjs)
(tested at commit `7f5309fef0a47545e34049903dbdae0f97285f7e`), reported via huntr's Model File
Vulnerability program.

## What these files are

- `malicious_manifest.json` — a weights manifest declaring a single weight, `malicious_weight`,
  of `dtype: "string"` and `shape: [500000000]` (500 million).
- `weights.bin` — the "backing" weight-data file the manifest points to. It is **completely
  empty (0 bytes)** — there is no real weight data behind the declared shape at all.
- `reproduce.js` — loads the manifest using `@tensorflow/tfjs`'s public, officially-documented
  `tf.io.weightsLoaderFactory` API (the same pattern shown in that function's own JSDoc example
  for loading weights from disk in Node.js without the native `tfjs-node` addon) — no internal or
  private functions are used.

## What happens when you run it

```
npm install @tensorflow/tfjs
node reproduce.js
```

The process becomes unresponsive (including a 2-second heartbeat timer in the script itself, which
does not fire while the vulnerable loop is running — the entire Node.js event loop is blocked, not
just the one loading operation) and, after roughly 3.5 minutes, **crashes outright** with a fatal
V8 out-of-memory error (`FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed -
JavaScript heap out of memory`, heap grown past 4 GB) — not merely a temporary freeze. `500000000`
was chosen so the demonstration completes in a few minutes; a real attacker could use an even
larger value (e.g. `999999999999`, still just a single JSON integer) for a longer/guaranteed crash
against a victim with more available memory. See the reporter's full write-up submitted via huntr
for the complete timing data and crash log.

This happens because `getWeightBytelength()` (`tfjs-core/src/io/io_utils.ts`) computes the
declared string-tensor size (`sizeFromShape(shape)`, unbounded, no validation) and loops that many
times over the weight's binary data — with no check that any real data is actually behind the
declared shape, and no early exit when the (in this case entirely empty) backing buffer is
exhausted.

## Scope note

This PoC is provided solely for the purpose of responsible vulnerability disclosure and
reproduction by the `tfjs` maintainers / huntr triage team. It is not intended for any other use.
Running it will make your own Node.js process unresponsive for the duration of the demo — this is
expected and is exactly the behavior being reported; do not run it against a shared or
production process.