CVE-2025-71329

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities	Exploit Third Party Advisory
https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439	Issue Tracking Patch
https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:image-size:image-size::::::::
	cpe:2.3:a:image-size:image-size::::::::

History

05 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) image-size hasta la versión 2.0.2 contiene una vulnerabilidad de denegación de servicio que permite a atacantes remotos bloquear permanentemente el bucle de eventos de Node.js al proporcionar un búfer de imagen especialmente diseñado con un campo de tamaño con valor cero en un tipo de caja reconocido. Los atacantes pueden desencadenar un bucle infinito en los analizadores de imágenes JXL o HEIF al proporcionar una imagen manipulada que contenga una caja con un tamaño de cero, lo que provoca que el desplazamiento nunca avance y cuelgue permanentemente la aplicación.

Information

Published : 2026-06-10 14:16

Updated : 2026-10-12 22:10

NVD link : CVE-2025-71329

Mitre link : CVE-2025-71329

CVE.ORG link : CVE-2025-71329

JSON object : View

Products Affected

image-size

image-size

CWE

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

{"id": "CVE-2025-71329", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "disclosure@vulncheck.com"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71329", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T14:45:56.403206Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/image-size/image-size", "vendor": "image-size", "product": "image-size", "versions": [{"status": "affected", "version": "1.1.0", "versionType": "semver", "lessThanOrEqual": "1.2.1"}, {"status": "affected", "version": "2.0.0", "versionType": "semver", "lessThanOrEqual": "2.0.2"}], "packageURL": "pkg:npm/image-size", "defaultStatus": "unaffected"}]}], "published": "2026-06-10T14:16:30.160", "references": [{"url": "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities", "tags": ["Exploit", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439", "tags": ["Issue Tracking", "Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application."}, {"lang": "es", "value": "image-size hasta la versi\u00f3n 2.0.2 contiene una vulnerabilidad de denegaci\u00f3n de servicio que permite a atacantes remotos bloquear permanentemente el bucle de eventos de Node.js al proporcionar un b\u00fafer de imagen especialmente dise\u00f1ado con un campo de tama\u00f1o con valor cero en un tipo de caja reconocido. Los atacantes pueden desencadenar un bucle infinito en los analizadores de im\u00e1genes JXL o HEIF al proporcionar una imagen manipulada que contenga una caja con un tama\u00f1o de cero, lo que provoca que el desplazamiento nunca avance y cuelgue permanentemente la aplicaci\u00f3n."}], "lastModified": "2026-10-12T22:10:00.247", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:image-size:image-size:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6DCF7FA-3496-4E9F-95EC-42259D47E3BC", "versionEndIncluding": "1.2.1", "versionStartIncluding": "1.1.0"}, {"criteria": "cpe:2.3:a:image-size:image-size:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4AAF768-3937-4DEE-801A-9E5E28D98096", "versionEndIncluding": "2.0.2", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}