CVE-2025-71319: image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
npm/image-sizefrom your environment.Uninstall the image-size package if it is not required, or replace it with an alternative image parser that does not exhibit this vulnerability.
- Configuration
Before parsing JXL/HEIF boxes, check the box size field and reject any box with a size of zero. Do not pass images containing zero-valued size fields to the image-size parser.
image-size parser validate_box_size_nonzero = true - Compensating control
Perform image parsing in isolated worker processes or separate containers and enforce CPU/time limits and request timeouts so a crafted image cannot permanently block the main Node.js event loop.
- Operational
Use process supervision (for example systemd, PM2, or similar) to detect and restart Node.js processes that become unresponsive due to image parsing; collect and inspect logs and the offending image buffers to support remediation.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71319?
The severity of CVE-2025-71319 is rated high with a score of 8.7.
How do I fix CVE-2025-71319?
To mitigate CVE-2025-71319, upgrade to image-size version 2.0.3 or later.
What type of attack is possible with CVE-2025-71319?
CVE-2025-71319 allows for a denial of service attack that can block the Node.js event loop.
Which software is affected by CVE-2025-71319?
CVE-2025-71319 affects the npm package image-size, specifically versions up to 2.0.2.
What triggers the vulnerability in CVE-2025-71319?
The vulnerability in CVE-2025-71319 is triggered by supplying a specially crafted image buffer with a zero-valued size field.