CVE-2025-71319
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
The image-size library through version 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers, causing the application to hang indefinitely.
Risk Assessment
The risk is that an unauthenticated remote attacker can permanently block the Node.js application, leading to service disruption and resource exhaustion.
Recommendation
Immediately update the image-size library to version 2.0.3 or later, which includes a fix that prevents the infinite loop when a zero size field is encountered.
Original NVD description (English source)
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.