CVE-2025-71330CWE-835

CVE-2025-71330

High · published June 10, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00430 · 36.2th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2026-06-10T18:16Z
Affected products (2)
ProductVersionsFixed in
image-size/image-size≥ 1.1.0, ≤ 1.2.1—
image-size/image-size≥ 2.0.0, ≤ 2.0.2—
References (3)
https://www.vulncheck.com/advisories/image-size-denial-of-service-via-malformed-icns-image-parsing · [email protected]https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities · [email protected]https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439 · [email protected]
EPSS history
Timeline
  • 10 JUN 13:02Z
    image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing
    cvelistv5