CVE-2025-71330
image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing
- State
- Published
- Severity
- 8.7 High
- Published
- Jun 10, 2026
- Updated
- Jul 14, 2026
- Reserved
- Jun 10, 2026
Description
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Affected Products
| Product | Versions |
|---|---|
image-sizeimage-size |
|
References
- https://joshua.hu/image-size-infinite-loop-dos-vulnerabilitiestechnical-descriptionexploit
- https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439issue-tracking
- https://www.vulncheck.com/advisories/image-size-denial-of-service-via-malformed-icns-image-parsingthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.