Junglewise Threat Intelligence

CVE-2025-71329: image-size infinite loop denial of service in JXL, HEIF, and ICNS parsers

CVE-2025-71329 · Severity: high · CVSS 7.5 · Published 2026-06-10

Technologies: Image-Size. Vendors: npm.

Executive brief

image-size is a Node.js package used to detect image dimensions from files in various formats. A denial of service vulnerability allows attackers to craft malicious image files that cause the application to enter an infinite loop, permanently blocking the event loop and hanging the application. This could be exploited by any service that processes user-supplied images, leading to service unavailability.

Technical details

The vulnerability exists in the JXL and HEIF image parsing code where a loop processes boxes based on incrementing an offset variable. When a crafted image contains a box with a size field of zero, the offset does not advance within the loop, causing an infinite loop. The root cause is insufficient validation of box size fields before using them in offset calculations. The attack vector is network-based and requires no authentication or user interaction—an attacker simply supplies a malicious image buffer to the parsing function. The vulnerability can be triggered by calling imageSize() with a crafted Uint8Array containing a box with size=0. The impact is a denial of service condition that permanently blocks the application's event loop, rendering it unresponsive. A patch was released in version 2.0.3 to validate and handle zero-sized boxes correctly.

Affected products

  • image-size image-size 1.1.0 through 2.0.2

Timeline

  • 2026-06-10: disclosed: Vulnerability published in GHSA and disclosed
  • 2026-06-10: patched: Fix released in version 2.0.3
  • 2026-06-10: advisory: GHSA-5p2g-fcmc-qvqq issued

References

Related threats