---
id: CVE-2025-71329
aliases:
  - GHSA-5p2g-fcmc-qvqq
title: >-
  image-size: JXL and HEIF parsers allow denial of service through infinite
  loops
summary: >-
  image-size: JXL and HEIF parsers allow denial of service through infinite
  loops
severity: high
cvss: 7.5
cwe:
  - CWE-835
vendor: image-size
product: image-size
ecosystem: npm
affected:
  - 'image-size >= 1.2.0, <= 2.0.2'
patched:
  - image-size 2.0.3
published: '2026-06-10'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T18:28:06Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-5p2g-fcmc-qvqq'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71329'
  - url: 'https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities'
  - url: >-
      https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439
  - url: >-
      https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser
  - url: >-
      https://codeberg.org/image-size/image-size/commit/e6e83a5578961de81f6d5834d90fb7430d8f29a5
  - url: 'https://github.com/advisories/GHSA-5p2g-fcmc-qvqq'
tags:
  - ghsa
  - npm
  - exploit-available
epss: 0.0043
epssPercentile: 0.34629
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/lcf2212dev/image-size-next'
  checkedAt: '2026-09-26T09:05:36.296Z'
exploitAvailable: true
ingestedAt: '2026-09-24T18:49:36.713Z'
---

## Overview

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.

## Affected packages

- `image-size >= 1.2.0, <= 2.0.2`

## Remediation

Upgrade to a patched release:

- `image-size 2.0.3`