image-size: JXL and HEIF parsers allow denial of service through infinite loops (CVE-2025-71329)
The image-size package up to version 2.0.2 contains a denial of service vulnerability in its JXL and HEIF image parsers. This flaw allows remote attackers to cause an infinite loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. The infinite loop causes the Node.js event loop to hang permanently, resulting in denial of service.
AI Analysis
Technical Summary
CVE-2025-71329 affects the image-size package versions up to and including 2.0.2. The vulnerability arises when the JXL or HEIF parsers encounter a crafted image containing a box with a size field set to zero. This causes the parser's offset to never advance, triggering an infinite loop that permanently blocks the Node.js event loop. The vulnerability is classified under CWE-835 (Loop with Unreachable Exit Condition) and has a CVSS v3.1 score of 7.5 (High). No known exploits are reported in the wild. No patch or official fix information is provided in the source data.
Potential Impact
Successful exploitation results in a denial of service by permanently hanging the Node.js event loop, making the affected application unresponsive. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted JXL or HEIF images with the vulnerable versions of image-size to mitigate the risk of denial of service.
image-size: JXL and HEIF parsers allow denial of service through infinite loops (CVE-2025-71329)
Description
The image-size package up to version 2.0.2 contains a denial of service vulnerability in its JXL and HEIF image parsers. This flaw allows remote attackers to cause an infinite loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. The infinite loop causes the Node.js event loop to hang permanently, resulting in denial of service.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-71329 affects the image-size package versions up to and including 2.0.2. The vulnerability arises when the JXL or HEIF parsers encounter a crafted image containing a box with a size field set to zero. This causes the parser's offset to never advance, triggering an infinite loop that permanently blocks the Node.js event loop. The vulnerability is classified under CWE-835 (Loop with Unreachable Exit Condition) and has a CVSS v3.1 score of 7.5 (High). No known exploits are reported in the wild. No patch or official fix information is provided in the source data.
Potential Impact
Successful exploitation results in a denial of service by permanently hanging the Node.js event loop, making the affected application unresponsive. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted JXL or HEIF images with the vulnerable versions of image-size to mitigate the risk of denial of service.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5p2g-fcmc-qvqq
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-71329"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a77429bbf8831d539b08022
Added to database: 08/08/2026, 14:52:11 UTC
Last enriched: 08/08/2026, 15:11:28 UTC
Last updated: 08/09/2026, 00:41:11 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.