PT-2026-48404 · Npm · Image-Size

Preston Price · CVE-2025-71330 · Published 2026-06-10 · Updated 2026-06-15

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions image-size versions prior to 2.0.3

Description A denial of service issue exists where remote attackers can permanently block the Node.js event loop by providing a specially crafted ICNS image buffer. By supplying an ICNS buffer with valid magic bytes and a zero-valued entry length field, an infinite loop is triggered in the ICNS parser because the offset is not incremented when the entry length is 0, causing the while loop condition to remain true indefinitely.

Recommendations Update to version 2.0.3 or later.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2025-71330

Affected Products

Image-Size

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71330.json · Exploit
• 🔥 https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-71330 · Security Note
• https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439 · Patch
• https://osv.dev/vulnerability/CVE-2025-71330 · Vendor Advisory
• https://github.com/image-size/image-size · Note
• https://twitter.com/VulmonFeeds/status/2064781944135561453 · Twitter Post
• https://t.me/cveNotify/166848 · Telegram Post
• https://vulncheck.com/advisories/image-size-denial-of-service-via-malformed-icns-image-parsing · Note
• https://twitter.com/CVEnew/status/2064709801460867080 · Twitter Post
• https://t.me/cveNotify/167450 · Telegram Post