image-size: ICNS parser allows denial of service through an infinite loop (CVE-2025-71330)
image-size versions up to 2.0.2 contain a denial of service vulnerability in the ICNS parser. A specially crafted ICNS image buffer with valid magic bytes and a zero-valued entry length can cause an infinite loop, blocking the Node.js event loop indefinitely. This vulnerability can be triggered remotely without authentication.
AI Analysis
Technical Summary
The image-size library through version 2.0.2 has a denial of service vulnerability (CVE-2025-71330) in its ICNS image parser. The flaw occurs when the parser encounters an ICNS buffer with valid magic bytes but an entry length field set to zero. Because the offset pointer is not incremented when the entry length is zero, the parser enters an infinite loop, causing the Node.js event loop to be permanently blocked. This vulnerability can be exploited remotely by supplying a malicious ICNS image buffer, resulting in a denial of service condition.
Potential Impact
An attacker can remotely cause a denial of service by supplying a crafted ICNS image buffer that triggers an infinite loop in the image-size ICNS parser. This blocks the Node.js event loop, potentially causing application unavailability. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, avoid processing untrusted ICNS image buffers with image-size versions up to 2.0.2.
image-size: ICNS parser allows denial of service through an infinite loop (CVE-2025-71330)
Description
image-size versions up to 2.0.2 contain a denial of service vulnerability in the ICNS parser. A specially crafted ICNS image buffer with valid magic bytes and a zero-valued entry length can cause an infinite loop, blocking the Node.js event loop indefinitely. This vulnerability can be triggered remotely without authentication.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The image-size library through version 2.0.2 has a denial of service vulnerability (CVE-2025-71330) in its ICNS image parser. The flaw occurs when the parser encounters an ICNS buffer with valid magic bytes but an entry length field set to zero. Because the offset pointer is not incremented when the entry length is zero, the parser enters an infinite loop, causing the Node.js event loop to be permanently blocked. This vulnerability can be exploited remotely by supplying a malicious ICNS image buffer, resulting in a denial of service condition.
Potential Impact
An attacker can remotely cause a denial of service by supplying a crafted ICNS image buffer that triggers an infinite loop in the image-size ICNS parser. This blocks the Node.js event loop, potentially causing application unavailability. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, avoid processing untrusted ICNS image buffers with image-size versions up to 2.0.2.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-w3rx-r6r6-pgpr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-71330"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a77429bbf8831d539b0801b
Added to database: 08/08/2026, 14:52:11 UTC
Last enriched: 08/08/2026, 15:11:16 UTC
Last updated: 08/09/2026, 02:44:01 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.