All vulnerabilities
CVE-2025-71329GHSA-5p2g-fcmc-qvqq

image-size: JXL and HEIF parsers allow denial of service through infinite loops

image-size image-sizenpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 10 Jun 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.43%Chance of exploitation activity in the next 30 days, higher than 36% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.0.3Fixed versionGitHub
Published10 Jun 2026Updated 24 Sep 2026CVE List

What fixes it

  • 2.0.3image-size, npmGitHubnpm install image-size@2.0.3

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.

Text from CVE List

Affected versions 4

  • image-size, npm>= 1.2.0, <= 2.0.2GitHub
  • image-sizeaffected: 1.1.0 through 1.2.1CVE List
  • image-sizeaffected: 2.0.0 through 2.0.2CVE List
  • image-size, npmfrom 1.2.0, fixed in 2.0.3OSV

References 6