CVE-2025-71330

Vulnerability

The image-size package, up to and including version 2.0.2, is susceptible to a denial of service vulnerability. This issue arises when parsing specially crafted ICNS image buffers. An attacker can provide an ICNS buffer with valid magic bytes and a zero-valued entry length field. This triggers an infinite loop within the ICNS parser because the offset is not incremented when the entry length is zero, causing the parsing loop to never terminate [3]. Similar infinite loops have been noted in HEIF and JP2 parsing due to zero-sized boxes [1].

Exploitation

An attacker can exploit this vulnerability by supplying a malicious ICNS image buffer to an application that uses the image-size package. The crafted buffer must contain the correct magic bytes for an ICNS file, followed by a zero-valued entry length field. This causes the parser to enter an infinite loop, as the offset used to track progress through the buffer remains static. No specific network position, authentication, or user interaction is mentioned as required, suggesting it can be triggered by simply processing a malicious file [2, 3].

Impact

Successful exploitation of this vulnerability allows a remote attacker to cause a denial of service. The infinite loop in the ICNS parser will permanently block the Node.js event loop. This effectively halts the application's ability to process further requests or perform any operations, leading to a complete service outage [3].

Mitigation

A fix for this vulnerability was merged in pull request #439 and is available in versions of image-size after 2.0.2. Users are strongly advised to update to a patched version as soon as possible. No workarounds are specified if updating is not immediately feasible. The package is not listed on the Known Exploited Vulnerabilities (KEV) catalog at this time [2].