CVE-2025-71329
image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.
| CWE | CWE-835 |
| Vendor | image-size |
| Product | image-size |
| Published | Jun 10, 2026 |
| Last Updated | Jun 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for image-size image-size
Be the first to know when new high vulnerabilities affecting image-size image-size are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
image-size / image-size
1.1.0 ≤ 1.2.1 2.0.0 ≤ 2.0.2
References
joshua.hu: https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities web.archive.org: https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439 vulncheck.com: https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser
Credits
Joshua Rogers (@MegaManSec)