CVE-2025-71319
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
The image-size library up to version 2.0.2 contains a denial of service vulnerability via an infinite loop in JXL or HEIF parsers. A specially crafted image with a zero size field causes the Node.js event loop to hang permanently.
Risk Assessment
An attacker can remotely block a Node.js application using image-size, causing permanent hang and denial of service.
Recommendation
Update the image-size library to version 2.0.3 or later, which contains the fix.
Other vulnerabilities in image-size
See all- CVE-2025-71330High
Version 2.0.2 of the image-size library contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field, triggering an infinite loop in the ICNS parser.
- CVE-2025-71329High
Version 2.0.2 of the image-size library contains a denial of service vulnerability that allows remote attackers to block the Node.js event loop. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by supplying a specially crafted image with a zero-valued size field.
Original NVD description (English source)
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.