# CVE-2025-71329: image-size infinite loop denial of service in JXL, HEIF, and ICNS parsers

Source: https://junglewise.ai/threats/cve-2025-71329-image-size-infinite-loop-denial-of-service-in-jxl-heif-and-icns  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-71329 · Severity: high · CVSS 7.5 · Published 2026-06-10

image-size is a Node.js package used to detect image dimensions from files in various formats. A denial of service vulnerability allows attackers to craft malicious image files that cause the application to enter an infinite loop, permanently blocking the event loop and hanging the application. This could be exploited by any service that processes user-supplied images, leading to service unavailability.

Technologies: [image-size (npm)](https://junglewise.ai/threats/technologies/image-size). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-71329 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-71329 being exploited in the wild.

**How severe is CVE-2025-71329?** High severity, with a CVSS score of 7.5, published 10 June 2026.

**Which products and versions are affected?** image-size (npm) <= 2.0.2, SEMVER:introduced=1.2.0,fixed=2.0.3.

**Is there a fix for CVE-2025-71329?** Yes. image-size (npm): upgrade to 2.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-71329 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-71329?** Check whether you run image-size (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- image-size (npm): upgrade to 2.0.3 or later

  ```sh
  npm install image-size@2.0.3
  ```


## Technical details

The vulnerability exists in the JXL and HEIF image parsing code where a loop processes boxes based on incrementing an offset variable. When a crafted image contains a box with a size field of zero, the offset does not advance within the loop, causing an infinite loop. The root cause is insufficient validation of box size fields before using them in offset calculations. The attack vector is network-based and requires no authentication or user interaction—an attacker simply supplies a malicious image buffer to the parsing function. The vulnerability can be triggered by calling imageSize() with a crafted Uint8Array containing a box with size=0. The impact is a denial of service condition that permanently blocks the application's event loop, rendering it unresponsive. A patch was released in version 2.0.3 to validate and handle zero-sized boxes correctly.

## Affected products

- image-size image-size 1.1.0 through 2.0.2

## Identifiers

- CVE-2025-71329
- GHSA-5p2g-fcmc-qvqq

## Timeline

- 2026-06-10: disclosed: Vulnerability published in GHSA and disclosed
- 2026-06-10: patched: Fix released in version 2.0.3
- 2026-06-10: advisory: GHSA-5p2g-fcmc-qvqq issued

## References

- [https://codeberg.org/image-size/image-size/commit/e6e83a5578961de81f6d5834d90fb7430d8f29a5](https://codeberg.org/image-size/image-size/commit/e6e83a5578961de81f6d5834d90fb7430d8f29a5)
- [https://github.com/image-size/image-size](https://github.com/image-size/image-size)
- [https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities](https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities)
- [https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439](https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439)
- [https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser](https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser)

## Related threats

- [image-size infinite loop in ICNS parser](https://junglewise.ai/threats/cve-2025-71330-image-size-infinite-loop-in-icns-parser)
- [image-size denial of service in findBox function](https://junglewise.ai/threats/cve-2025-71319-image-size-denial-of-service-in-findbox-function)