{"id":"CVE-2025-71329","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-06-10T14:16:30.160","lastModified":"2026-10-12T22:10:00.247","vulnStatus":"Analyzed","cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application."},{"lang":"es","value":"image-size hasta la versión 2.0.2 contiene una vulnerabilidad de denegación de servicio que permite a atacantes remotos bloquear permanentemente el bucle de eventos de Node.js al proporcionar un búfer de imagen especialmente diseñado con un campo de tamaño con valor cero en un tipo de caja reconocido. Los atacantes pueden desencadenar un bucle infinito en los analizadores de imágenes JXL o HEIF al proporcionar una imagen manipulada que contenga una caja con un tamaño de cero, lo que provoca que el desplazamiento nunca avance y cuelgue permanentemente la aplicación."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"image-size","product":"image-size","defaultStatus":"unaffected","repo":"https://github.com/image-size/image-size","packageURL":"pkg:npm/image-size","versions":[{"version":"1.1.0","lessThanOrEqual":"1.2.1","versionType":"semver","status":"affected"},{"version":"2.0.0","lessThanOrEqual":"2.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-10T14:45:56.403206Z","id":"CVE-2025-71329","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:image-size:image-size:*:*:*:*:*:*:*:*","versionStartIncluding":"1.1.0","versionEndIncluding":"1.2.1","matchCriteriaId":"E6DCF7FA-3496-4E9F-95EC-42259D47E3BC"},{"vulnerable":true,"criteria":"cpe:2.3:a:image-size:image-size:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndIncluding":"2.0.2","matchCriteriaId":"D4AAF768-3937-4DEE-801A-9E5E28D98096"}]}]}],"references":[{"url":"https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities","source":"disclosure@vulncheck.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439","source":"disclosure@vulncheck.com","tags":["Issue Tracking","Patch"]},{"url":"https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}