All vulnerabilities
CVE-2025-71330GHSA-w3rx-r6r6-pgpr

image-size: ICNS parser allows denial of service through an infinite loop

image-size image-sizenpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 10 Jun 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.43%Chance of exploitation activity in the next 30 days, higher than 36% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.0.3Fixed versionGitHub
Published10 Jun 2026Updated 24 Sep 2026CVE List

What fixes it

  • 2.0.3image-size, npmGitHubnpm install image-size@2.0.3

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.

Text from CVE List

Affected versions 4

  • image-size, npm>= 0.6.3, <= 2.0.2GitHub
  • image-sizeaffected: 1.1.0 through 1.2.1CVE List
  • image-sizeaffected: 2.0.0 through 2.0.2CVE List
  • image-size, npmfrom 0.6.3, fixed in 2.0.3OSV

References 6