# CVE-2025-71319: image-size denial of service in findBox function

Source: https://junglewise.ai/threats/cve-2025-71319-image-size-denial-of-service-in-findbox-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2025-71319 · Severity: high · CVSS 7.5 · Published 2026-06-09

The image-size library, used by applications to detect image dimensions, is vulnerable to a denial-of-service attack. By providing a specially crafted image file (such as JXL, HEIF, or JP2), an attacker can cause the application to enter an infinite loop. This results in the application hanging or becoming unresponsive, potentially disrupting services that process user-uploaded images.

Technologies: [image-size (npm)](https://junglewise.ai/threats/technologies/image-size). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-71319 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-71319 being exploited in the wild.

**How severe is CVE-2025-71319?** High severity, with a CVSS score of 7.5, published 9 June 2026.

**Which products and versions are affected?** image-size (npm) SEMVER:introduced=1.1.0,fixed=1.2.1.

**Is there a fix for CVE-2025-71319?** Yes. image-size (npm): upgrade to 1.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-71319 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-71319?** Check whether you run image-size (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- image-size (npm): upgrade to 1.2.1 or later

  ```sh
  npm install image-size@1.2.1
  ```


## Technical details

A denial-of-service vulnerability exists in the image-size library due to an infinite loop in the findBox function. The root cause is a failure to properly handle image boxes with a size of zero in JXL, HEIF, and JP2 file formats. When a box size of zero is encountered, the offset variable used to traverse the file is not incremented, causing the while loop to execute indefinitely. This can be triggered remotely by providing a malicious image file to any application using the library to validate or size images. The issue is fixed in versions 1.2.1 and 2.0.2.

## Affected products

- image-size image-size >=1.1.0 <1.2.1, >=2.0.0 <2.0.2

## Identifiers

- CVE-2025-71319
- GHSA-m5qc-5hw7-8vg7

## Timeline

- 2025-04-02: advisory: GHSA-m5qc-5hw7-8vg7 published
- 2026-06-09: disclosed: NVD publication date

## References

- [https://github.com/image-size/image-size/security/advisories/GHSA-m5qc-5hw7-8vg7](https://github.com/image-size/image-size/security/advisories/GHSA-m5qc-5hw7-8vg7)
- [https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-findbox-function](https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-findbox-function)

## Related threats

- [image-size infinite loop in ICNS parser](https://junglewise.ai/threats/cve-2025-71330-image-size-infinite-loop-in-icns-parser)
- [image-size infinite loop denial of service in JXL, HEIF, and ICNS parsers](https://junglewise.ai/threats/cve-2025-71329-image-size-infinite-loop-denial-of-service-in-jxl-heif-and-icns)