CVE-2025-71329
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Version 2.0.2 of the image-size library contains a denial of service vulnerability that allows remote attackers to block the Node.js event loop. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by supplying a specially crafted image with a zero-valued size field.
Risk Assessment
This vulnerability can lead to permanent application hangs, affecting service availability. Organizations may experience downtime and loss of user trust.
Recommendation
It is recommended to update the image-size library to the latest version to mitigate this vulnerability. Additionally, applications should be monitored for unauthorized attempts to supply malicious images.
Original NVD description (English source)
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.