CVE-2025-71330
image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.
- Record
CVE-2025-71330- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
EUVDEUVD-2025-210105
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.
- Record
EUVD-2025-210105- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w3rx-r6r6-pgpr
image-size: ICNS parser allows denial of service through an infinite loop
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.
- Record
GHSA-w3rx-r6r6-pgpr- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
NVD
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.
- Record
CVE-2025-71330- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSV
image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.
- Record
CVE-2025-71330- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVGHSA-w3rx-r6r6-pgpr
image-size: ICNS parser allows denial of service through an infinite loop
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.
- Record
GHSA-w3rx-r6r6-pgpr- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
Show 6 moreShow less
OSVCLSA-2026-1791199971 No score
TuxCare security update for image-size (2 CVEs)
TuxCare rebuilt image-size to address 2 CVEs. Fixed in 0.5.5-tuxcare.1.
- Record
CLSA-2026-1791199971- Updated
- 2026-11-02
OSVCLSA-2026-1791200036 No score
TuxCare security update for image-size (2 CVEs)
TuxCare rebuilt image-size to address 2 CVEs. Fixed in 1.2.1-tuxcare.1.
- Record
CLSA-2026-1791200036- Updated
- 2026-11-02
OSVCLSA-2026-1791208774 No score
TuxCare security update for image-size (2 CVEs)
TuxCare rebuilt image-size to address 2 CVEs. Fixed in 2.0.2-tuxcare.1.
- Record
CLSA-2026-1791208774- Updated
- 2026-11-02
OSVCLSA-2026-1792743661 No score
TuxCare security update for image-size (1 CVE)
TuxCare rebuilt image-size to address 1 CVE. Fixed in 0.6.3-tuxcare.1.
- Record
CLSA-2026-1792743661- Updated
- 2026-11-02
OSVCLSA-2026-1792743831 No score
TuxCare security update for image-size (1 CVE)
TuxCare rebuilt image-size to address 1 CVE. Fixed in 0.7.5-tuxcare.1.
- Record
CLSA-2026-1792743831- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2025-71330 No score
CVE-2025-71330 in image-size - Patched by Root
Root has patched CVE-2025-71330 in the image-size package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2025-71330- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
image-sizenpm |
0.6.3 to 2.0.2 | 2.0.3 |
image-sizeTuxCare:npm From an advisory covering 2 CVEs |
0.5.5-tuxcare.0 up to 0.5.5-tuxcare.1, plus listed versions 0.5.5 |
0.5.5-tuxcare.1 |
image-sizeTuxCare:npm From an advisory covering 2 CVEs |
1.2.1-tuxcare.0 up to 1.2.1-tuxcare.1, plus listed versions 1.2.1 |
1.2.1-tuxcare.1 |
image-sizeTuxCare:npm From an advisory covering 2 CVEs |
2.0.2-tuxcare.0 up to 2.0.2-tuxcare.1, plus listed versions 2.0.2 |
2.0.2-tuxcare.1 |
image-sizeTuxCare:npm |
0.6.3-tuxcare.0 up to 0.6.3-tuxcare.1, plus listed versions 0.6.3 |
0.6.3-tuxcare.1 |
image-sizeTuxCare:npm |
0.7.5-tuxcare.0 up to 0.7.5-tuxcare.1, plus listed versions 0.7.5 |
0.7.5-tuxcare.1 |
image-sizenpm |
0.6.3 up to 2.0.3 | 2.0.3 |
image-sizeRoot:npm |
before 0.6.3-aikido.2 | 0.6.3-aikido.21.2.1-aikido.22.0.2-aikido.10.6.3-aikido.11.0.0-aikido.1 |
@rootio/image-sizeRoot:npm |
before 0.6.3-root.io.2 | 0.6.3-root.io.21.2.1-root.io.22.0.2-root.io.10.6.3-root.io.11.0.0-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-71330 is a high vulnerability (CVSS 8.7) in Image-size, published June 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in image-size 2.0.3.
References
joshua.hu/image-size-infinite-loop-dos-vulnerabilities
web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439
vulncheck.com/advisories/image-size-denial-of-service-via-malformed-icns-image-parsing
nvd.nist.gov/vuln/detail/CVE-2025-71330
codeberg.org/image-size/image-size/commit/e6e83a5578961de81f6d5834d90fb7430d8f29a5
github.com/advisories/GHSA-w3rx-r6r6-pgpr