Threats tagged 'ghsa-5p2g-fcmc-qvqq'

The image-size package up to version 2.0.2 contains a denial of service vulnerability in its JXL and HEIF image parsers. This flaw allows remote attackers to cause an infinite loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. The infinite loop causes the Node.js event loop to hang permanently, resulting in denial of service.