image-size 2.0.2 vulnerabilities

Version 2.0.2 of the image-size library contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field, triggering an infinite loop in the ICNS parser.

Version 2.0.2 of the image-size library contains a denial of service vulnerability that allows remote attackers to block the Node.js event loop. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by supplying a specially crafted image with a zero-valued size field.

The image-size library up to version 2.0.2 contains a denial of service vulnerability via an infinite loop in JXL or HEIF parsers. A specially crafted image with a zero size field causes the Node.js event loop to hang permanently.