---
id: CVE-2025-71319
title: >-
  image-size through 2.0.2 contains a denial of service vulnerability that
  allows remote attackers to permanently block the Node.js event loop by
  supplying a specially crafted image buffer with a zero-valued size field in a
  recognized box-…
summary: >-
  image-size through 2.0.2 contains a denial of service vulnerability that
  allows remote attackers to permanently block the Node.js event loop by
  supplying a specially crafted image buffer with a zero-valued size field in a
  recognized box-…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-835
  - CWE-835
vendor: image-size
product: image-size
affected:
  - image-size <= 2.0.2
published: '2026-06-09'
updated: '2026-07-03'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71319'
references:
  - url: 'https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities'
    label: disclosure@vulncheck.com
  - url: >-
      https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser
    label: disclosure@vulncheck.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:33313'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2025-71319'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2487296'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71319.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
epss: 0.00729
epssPercentile: 0.52237
ingestedAt: '2026-07-03T14:03:37.085Z'
---

## Overview

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.

## Affected

- `image-size <= 2.0.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.