Executive brief
image-size is a popular Node.js library used to detect the dimensions of various image formats. A vulnerability in its ICNS (Apple Icon) parser allows an attacker to provide a specially crafted image file that causes the application to enter an infinite loop. This effectively freezes the Node.js event loop, leading to a complete denial of service where the application can no longer process any other requests or tasks.
Technical details
A denial of service vulnerability exists in the ICNS parser of the image-size library (versions up to 2.0.2). The root cause is a loop with an unreachable exit condition (CWE-835) in the ICNS detection logic. When the parser encounters an ICNS buffer with valid magic bytes but an entry length field set to zero, the internal offset pointer fails to increment. Because the offset never advances, the 'while' loop condition remains true indefinitely, permanently blocking the Node.js event loop. This can be triggered remotely if the application accepts and processes untrusted image data. As of the advisory date, no official patch has been merged, though community pull requests have been proposed.
Affected products
- image-size image-size <= 2.0.2
Timeline
- 2025-04-18: other: Initial community pull request for related infinite loop issues
- 2025-09-19: disclosed: Vulnerability details published by researcher Joshua Rogers
- 2026-06-10: advisory: GitHub Advisory and CVE-2025-71330 published