PT-2026-48403 · Npm · Image-Size

Joshua Rogers · Published 2026-06-10 · Updated 2026-06-10 · CVE-2025-71329

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions image-size versions prior to 2.0.3

Description A denial of service issue exists where remote attackers can permanently block the Node.js event loop. By supplying a specially crafted image buffer containing a box-type with a zero-valued size field, an infinite loop is triggered within the JXL or HEIF image parsers. This causes the offset to never advance, resulting in the application hanging permanently.

Recommendations Update to version 2.0.3 or later.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2025-71329

Affected Products

Image-Size

References · 5

• 🔥 https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-71329 · Security Note
• https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439 · Patch
• https://vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser · Note
• https://twitter.com/CVEnew/status/2064709799120413101 · Twitter Post