CVE-2025-71319

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-71319
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities Exploit Third Party Advisory
https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439 Issue Tracking Patch
https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:image-size:image-size:*:*:*:*:*:node.js:*:*
History

15 Jun 2026, 17:52

Type Values Removed Values Added
CPE cpe:2.3:a:image-size:image-size:*:*:*:*:*:node.js:*:*
First Time Image-size image-size
Image-size
References () https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities - () https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities - Exploit, Third Party Advisory
References () https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439 - () https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439 - Issue Tracking, Patch
References () https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser - () https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser - Third Party Advisory

10 Jun 2026, 14:16

Type Values Removed Values Added
Summary (en) image-size 1.1.0 before 1.2.1 and 2.0.0 before 2.0.2 contain a denial of service vulnerability in the findBox function when processing specially crafted images with zero-sized boxes. Remote attackers can cause application hang by supplying malicious JXL, HEIF, or JP2 image files with box size zero, triggering infinite loops during image validation. (en) image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.
References
  • {'url': 'https://github.com/image-size/image-size/security/advisories/GHSA-m5qc-5hw7-8vg7', 'source': 'disclosure@vulncheck.com'}
  • {'url': 'https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-findbox-function', 'source': 'disclosure@vulncheck.com'}
  • () https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities -
  • () https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439 -
  • () https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser -

09 Jun 2026, 21:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-09 21:17

Updated : 2026-06-15 17:52

NVD link : CVE-2025-71319

Mitre link : CVE-2025-71319

CVE.ORG link : CVE-2025-71319

JSON object : View

Products Affected

image-size

  • image-size
CWE
CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')