{"id":"CVE-2025-71329","aliases":["CLSA-2026-1791199971","CLSA-2026-1791200036","CLSA-2026-1791208774","EUVD-2025-210106","GHSA-5p2g-fcmc-qvqq","ROOT-APP-NPM-CVE-2025-71329"],"status":"published","title":"image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser","description":"image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0043,"percentile":0.37728,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-835"],"published":"2026-06-10T13:04:30Z","modified":"2026-11-09T02:46:42Z","exploits":[{"source":"pocgithub","id":"lcf2212dev/image-size-next","title":"lcf2212dev/image-size-next","date":"2026-08-10","url":"https://github.com/lcf2212dev/image-size-next"}],"fixes":[{"ecosystem":"npm","package":"image-size","fixed_in":["2.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"image-size","fixed_in":["0.5.5-aikido.1","0.6.3-aikido.2","1.2.1-aikido.2","2.0.2-aikido.1","1.2.1-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/image-size","fixed_in":["0.5.5-root.io.1","0.6.3-root.io.2","1.2.1-root.io.2","2.0.2-root.io.1","1.2.1-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"image-size","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"last_affected":"2.0.2"},{"fixed":"2.0.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"image-size","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.5-tuxcare.0"},{"fixed":"0.5.5-tuxcare.1"}]}],"versions":["0.5.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"image-size","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.1-tuxcare.0"},{"fixed":"1.2.1-tuxcare.1"}]}],"versions":["1.2.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"image-size","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.2-tuxcare.0"},{"fixed":"2.0.2-tuxcare.1"}]}],"versions":["2.0.2"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"image-size","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.0"},{"fixed":"2.0.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"image-size","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.5-aikido.1"},{"fixed":"0.6.3-aikido.2"},{"fixed":"1.2.1-aikido.2"},{"fixed":"2.0.2-aikido.1"},{"fixed":"1.2.1-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/image-size","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.5-root.io.1"},{"fixed":"0.6.3-root.io.2"},{"fixed":"1.2.1-root.io.2"},{"fixed":"2.0.2-root.io.1"},{"fixed":"1.2.1-root.io.1"}]}]}],"products":[{"vendor":"image-size","product":"image-size"}],"references":[{"url":"https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities","tags":["technical-description","exploit","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439","tags":["issue-tracking","patch","Issue Tracking","Patch","fix","web"]},{"url":"https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser","tags":["third-party-advisory","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71329","tags":["advisory"]},{"url":"https://codeberg.org/image-size/image-size/commit/e6e83a5578961de81f6d5834d90fb7430d8f29a5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5p2g-fcmc-qvqq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71329.json","tags":["advisory"]},{"url":"https://github.com/image-size/image-size","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-71329","title":"image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser","description":"image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.","status":"published","published":"2026-06-10T13:04:30.38Z","modified":"2026-11-08T14:00:26.865Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-08T14:43:22.764053Z"}],"euvd":[{"id":"EUVD-2025-210106","description":"image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.","status":"published","published":"2026-06-10T13:04:30Z","modified":"2026-11-08T14:00:26Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-08T15:13:10.25084Z"}],"ghsa":[{"id":"GHSA-5p2g-fcmc-qvqq","title":"image-size: JXL and HEIF parsers allow denial of service through infinite loops","description":"image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.","status":"published","published":"2026-06-10T15:31:30Z","modified":"2026-09-24T18:28:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:41:21.616682Z"}],"nvd":[{"id":"CVE-2025-71329","description":"image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.","status":"published","published":"2026-06-10T14:16:30.16Z","modified":"2026-10-12T22:10:00.247Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:12:02.535029Z"}],"osv":[{"id":"CVE-2025-71329","title":"image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser","description":"image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.","status":"published","published":"2026-06-10T13:04:30.38Z","modified":"2026-11-09T02:46:42.447583693Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-09T03:16:24.800471Z"},{"id":"GHSA-5p2g-fcmc-qvqq","title":"image-size: JXL and HEIF parsers allow denial of service through infinite loops","description":"image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.","status":"published","published":"2026-06-10T15:31:30Z","modified":"2026-09-24T18:45:10.915244487Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"CLSA-2026-1791199971","title":"TuxCare security update for image-size (2 CVEs)","description":"TuxCare rebuilt image-size to address 2 CVEs. Fixed in 0.5.5-tuxcare.1.","status":"published","published":"2026-10-05T11:32:51Z","modified":"2026-10-15T09:47:39.249078211Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791200036","title":"TuxCare security update for image-size (2 CVEs)","description":"TuxCare rebuilt image-size to address 2 CVEs. Fixed in 1.2.1-tuxcare.1.","status":"published","published":"2026-10-05T11:33:56Z","modified":"2026-10-15T09:47:58.15291763Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791208774","title":"TuxCare security update for image-size (2 CVEs)","description":"TuxCare rebuilt image-size to address 2 CVEs. Fixed in 2.0.2-tuxcare.1.","status":"published","published":"2026-10-05T13:59:34Z","modified":"2026-10-15T09:46:51.415796319Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"ROOT-APP-NPM-CVE-2025-71329","title":"CVE-2025-71329 in image-size - Patched by Root","description":"Root has patched CVE-2025-71329 in the image-size package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-29T08:41:28Z","modified":"2026-09-29T09:15:06.791565931Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}