CVE-2025-71329

About vulnerability

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.

Affected product:

AngularJS , React , async-storage , docusaurus , docusaurus-core , docusaurus-mdx-loader , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-search-algolia , expo , expo-application , expo-camera , expo-cli , expo-device , expo-file-system , expo-glass-effect , expo-localization , expo-manifests , expo-module-scripts , expo-updates , expo-updates-interface , expo-vector-icons , image-size , ipx , json-render , less , less-loader , lingui-babel-plugin-lingui-macro , loaders.gl , loaders.gl-gltf , localforage-asyncstorage-driver , luma.gl-gltf , magic-js , magiclabs/magic-js , masked-view , metro , mobile-wallet-adapter , module-federation-core , module-federation/core , netlify-dev , netlify-edge-functions , netlify-functions-dev , netlify-nuxt , netlify-redirects , netlify-runtime , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , nitro , onflow-fcl-react-native , op-sqlite , posthog-react-native-plugin , primitives , recyclerlistview , rsbuild-image , texture-compressor , unstorage , victory-native , vite , vite-plugin-basic-ssl , wallet-adapter , walletconnect-monorepo , walletconnect-utils , zephyr-packages

Affected packages:

image-size @ 1.0.0 (+889 more)