CVE-2025-71330

A flaw was found in image-size. A remote attacker can exploit this vulnerability by providing a specially crafted ICNS image buffer. This malicious buffer, containing valid magic bytes and a zero-valued entry length, causes an infinite loop in the ICNS parser. This can permanently block the Node.js event loop, leading to a denial of service (DoS) for the affected system.

A flaw was found in the image-size npm package. A crafted ICNS image buffer with a zero-valued entry length field can trigger an infinite loop in the ICNS parser, permanently blocking the Node.js event loop and causing a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to a version of image-size that validates ICNS entry length fields. As a workaround, validate image inputs before passing them to image-size, rejecting ICNS files with zero-length entries.