CVE-2025-71330
CVE-2025-71330 · image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing
This page contains facts from public vulnerability sources. Check the original advisory before updating.
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.
CVSS 8.7 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
image-size
- Versions
- ≥ 1.1.0, ≤ 1.2.1: Affected (semver)
- ≥ 2.0.0, ≤ 2.0.2: Affected (semver)
No fix published
image-size npm
- Affected ranges
- SEMVER: ≥ 0.6.3, < 2.0.3
Update to 2.0.3