Vulnerability · Published Jun 10, 2026 · Assigned by VulnCheck
CVE-2025-71330image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing
High 7.5
In plain English
A high-severity infinite loop in image-size from image-size. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | image-size | 2.0.3 | GHSA-w3rx-r6r6-pgpr |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| image-size | image-size | 1.1.0 – through 1.2.12.0.0 – through 2.0.2 |
Weakness: CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities technical-description, exploit
- https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439 issue-tracking
- https://www.vulncheck.com/advisories/image-size-denial-of-service-via-malformed-icns-image-parsing third-party-advisory