CVE-2025-71319
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
The image-size library version 2.0.2 and earlier contains a denial of service vulnerability. A remote attacker can supply a crafted image with a zero-valued size field in a recognized box type, causing an infinite loop in the JXL or HEIF parsers and permanently hanging the Node.js event loop.
Risk Assessment
An attacker can permanently block the Node.js application using this library for image processing, causing service unavailability for users.
Recommendation
Update the image-size library to a version newer than 2.0.2 where the vulnerability is fixed. If an update is not possible, implement input validation before passing data to the library.
Original NVD description (English source)
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.