{"id":"CVE-2025-71329","published":"2026-06-10T13:04:30Z","modified":"2026-07-14T22:26:08Z","title":"image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser","vendor":"image-size","product":"image-size","tier":"tail","description":{"text":"image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0043,"percentile":0.37168,"provenance":"source"},"cwes":[{"id":"CWE-835","name":"Loop with Unreachable Exit Condition"}],"references":[{"url":"https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities","tags":["technical-description","exploit"]},{"url":"https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439","tags":["issue-tracking"]},{"url":"https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser","tags":["third-party-advisory"]}],"priority":{"score":17.7,"factors":[{"name":"EPSS percentile","points":7.43},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":5.25}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-08-10","earliestUrl":"https://github.com/lcf2212dev/image-size-next","repos":[{"name":"lcf2212dev/image-size-next","url":"https://github.com/lcf2212dev/image-size-next","stars":8,"created":"2026-08-10"}]},"first":{"date":"2026-08-10","source":"PoC-in-GitHub","url":"https://github.com/lcf2212dev/image-size-next"},"provenance":"source"},"vendorSlug":"image-size","affectedVersions":[{"vendor":"image-size","product":"image-size","versions":[">= 1.1.0, <= 1.2.1",">= 2.0.0, <= 2.0.2"]}],"affected":[{"ecosystem":"npm","package":"image-size","vulnerableRanges":[">=1.2.0, <2.0.3"],"patched":["2.0.3"],"from":["GHSA-5p2g-fcmc-qvqq"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-210106","exploited":false,"provenance":"source"},"exploitRefs":["https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities"],"lineage":{"familyId":"fam-image-size-cve-2025-71319","packageHistory":[{"cve":"CVE-2025-71319","published":"2026-06-09","fixed":"2.0.2","kev":false,"link":{"from":"CVE-2025-71319","to":"CVE-2025-71329","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:image-size","fromFixed":"2.0.2","toFixed":"2.0.3","daysApart":1},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2025-71329","published":"2026-06-10","fixed":"2.0.3","kev":false},{"cve":"CVE-2025-71330","published":"2026-06-10","fixed":"2.0.3","kev":false}],"package":"npm:image-size"}}