Threats affecting pkg:npm/image-size

CVE-2025-71329 is a denial of service vulnerability in the image-size library up to version 2.0.2. It allows remote attackers to cause an infinite loop in the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. This triggers an infinite loop in the JXL or HEIF image parsers, causing the application to hang permanently.

CVE-2025-71330 is a denial of service vulnerability in the image-size library up to version 2.0.2. It allows remote attackers to cause an infinite loop in the ICNS image parser by supplying a specially crafted ICNS buffer with a zero-valued entry length field. This infinite loop blocks the Node.js event loop permanently, causing a denial of service.

CVE-2025-71319 is a denial of service vulnerability in the image-size library versions 1.1.0 through 1.2.1 and 2.0.0 through 2.0.2. It occurs when processing specially crafted JXL, HEIF, or JP2 image files containing zero-sized boxes, causing an infinite loop in the findBox function. This infinite loop results in the Node.js event loop being permanently blocked, hanging the application and disrupting service availability.