CVE-2025-71329

A flaw was found in image-size. A remote attacker can exploit this vulnerability by providing a specially crafted image buffer that contains a zero-valued size field within a recognized box-type. This malicious input can trigger an infinite loop in the JXL or HEIF image parsers, leading to a permanent block of the Node.js event loop. The consequence is a Denial of Service (DoS), causing the application to become unresponsive.

A flaw was found in the image-size npm package. A crafted image buffer with a zero-valued size field in a recognized box-type (JXL or HEIF) can trigger an infinite loop, permanently blocking the Node.js event loop and causing a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to a version of image-size that validates box size fields. As a workaround, validate image inputs before passing them to image-size, rejecting files with zero-length box entries.