Denial of Service Vulnerability in Image-Size for Node.js

CVE-2025-71330

What is CVE-2025-71330?

The image-size package through version 2.0.2 exhibits a denial of service vulnerability that can be exploited by remote attackers. By providing a specially crafted ICNS image buffer, an attacker can trigger an infinite loop in the ICNS parser, effectively blocking the Node.js event loop. This occurs when the crafted buffer includes valid magic bytes and a zero-valued entry length field, preventing the offset from incrementing, leading to a perpetual true condition within the while loop. The result is a complete hang of the application processing the malformed image, demonstrating the critical need for immediate upgrading or patching to mitigate this risk.

References