---
id: CVE-2025-71329
title: >-
  image-size through 2.0.2 contains a denial of service vulnerability that
  allows remote attackers to permanently block the Node.js event loop by
  supplying a specially crafted image buffer with a zero-valued size field in a
  recognized box-…
summary: >-
  image-size through 2.0.2 contains a denial of service vulnerability that
  allows remote attackers to permanently block the Node.js event loop by
  supplying a specially crafted image buffer with a zero-valued size field in a
  recognized box-…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-835
vendor: image-size
product: image-size
affected:
  - 'image-size >= 1.1.0, <= 1.2.1'
  - 'image-size >= 2.0.0, <= 2.0.2'
patched:
  - image-size 2.0.3
published: '2026-06-10'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T22:10:00.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71329'
references:
  - url: 'https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities'
    label: disclosure@vulncheck.com
  - url: >-
      https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser
    label: disclosure@vulncheck.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71329'
  - url: >-
      https://codeberg.org/image-size/image-size/commit/e6e83a5578961de81f6d5834d90fb7430d8f29a5
  - url: 'https://github.com/advisories/GHSA-5p2g-fcmc-qvqq'
tags:
  - nvd
  - exploit-available
  - ghsa
  - npm
epss: 0.0043
epssPercentile: 0.37095
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/lcf2212dev/image-size-next'
  checkedAt: '2026-10-27T16:51:41.092Z'
exploitAvailable: true
aliases:
  - GHSA-5p2g-fcmc-qvqq
ecosystem: npm
ingestedAt: '2026-09-24T18:49:36.713Z'
---

## Overview

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.

## Affected

- `image-size >= 1.1.0, <= 1.2.1`
- `image-size >= 2.0.0, <= 2.0.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2025-71329)

Affected packages:

- `image-size >= 1.2.0, <= 2.0.2`

Patched in:

- `image-size 2.0.3`

Source: https://github.com/advisories/GHSA-5p2g-fcmc-qvqq