CVE-2025-71330

image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.

Affected

image-size

CVSS v4.0 VULNCHECK

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULNCHECK

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.43% chance of exploitation in the next 30 days, 36th percentile

Published

2026-06-10

Updated

2026-07-14

Proof-of-concept exploits (1)

• https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities

Security advisories

• https://www.vulncheck.com/advisories/image-size-denial-of-service-via-malformed-icns-imag…
• advisories/GHSA-w3rx-r6r6-pgpr
• https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/…

References

• CVE Record
• NVD entry