CVE-2025-71330: image-size infinite loop in ICNS parser

CVE-2025-71330 · Severity: high · CVSS 7.5 · Published 2026-06-10

image-size is a popular Node.js library used to detect the dimensions of various image formats. A vulnerability in its ICNS (Apple Icon) parser allows an attacker to provide a specially crafted image file that causes the application to enter an infinite loop. This effectively freezes the Node.js event loop, leading to a complete denial of service where the application can no longer process any other requests or tasks.

Technologies: image-size (npm). Vendors: npm.

Quick answers

Is CVE-2025-71330 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-71330 being exploited in the wild.
How severe is CVE-2025-71330?
High severity, with a CVSS score of 7.5, published 10 June 2026.
Which products and versions are affected?
image-size (npm) <= 2.0.2, SEMVER:introduced=0.6.3,fixed=2.0.3.
Is there a fix for CVE-2025-71330?
Yes. image-size (npm): upgrade to 2.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-71330 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-71330?
Check whether you run image-size (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • image-size (npm): upgrade to 2.0.3 or later
    npm install image-size@2.0.3

Technical details

A denial of service vulnerability exists in the ICNS parser of the image-size library (versions up to 2.0.2). The root cause is a loop with an unreachable exit condition (CWE-835) in the ICNS detection logic. When the parser encounters an ICNS buffer with valid magic bytes but an entry length field set to zero, the internal offset pointer fails to increment. Because the offset never advances, the 'while' loop condition remains true indefinitely, permanently blocking the Node.js event loop. This can be triggered remotely if the application accepts and processes untrusted image data. As of the advisory date, no official patch has been merged, though community pull requests have been proposed.

Affected products

  • image-size image-size <= 2.0.2

Identifiers

  • CVE-2025-71330
  • GHSA-w3rx-r6r6-pgpr

Timeline

  • 2025-04-18: other: Initial community pull request for related infinite loop issues
  • 2025-09-19: disclosed: Vulnerability details published by researcher Joshua Rogers
  • 2026-06-10: advisory: GitHub Advisory and CVE-2025-71330 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.