Executive brief
The image-size library, used by applications to detect image dimensions, is vulnerable to a denial-of-service attack. By providing a specially crafted image file (such as JXL, HEIF, or JP2), an attacker can cause the application to enter an infinite loop. This results in the application hanging or becoming unresponsive, potentially disrupting services that process user-uploaded images.
Technical details
A denial-of-service vulnerability exists in the image-size library due to an infinite loop in the findBox function. The root cause is a failure to properly handle image boxes with a size of zero in JXL, HEIF, and JP2 file formats. When a box size of zero is encountered, the offset variable used to traverse the file is not incremented, causing the while loop to execute indefinitely. This can be triggered remotely by providing a malicious image file to any application using the library to validate or size images. The issue is fixed in versions 1.2.1 and 2.0.2.
Affected products
- image-size image-size >=1.1.0 <1.2.1, >=2.0.0 <2.0.2
Timeline
- 2025-04-02: advisory: GHSA-m5qc-5hw7-8vg7 published
- 2026-06-09: disclosed: NVD publication date