CVE-2025-71329: image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Validate box size fields during parsing and fail/reject any image that contains a zero-valued box size to prevent the parser offset from becoming stuck in an infinite loop.
image-size (JXL/HEIF parser) box_size_zero_handling = reject - Compensating control
Process untrusted JXL/HEIF images in an isolated worker or separate process with timeouts and resource limits so a crafted image cannot permanently block the main Node.js event loop; kill or restart the worker if it becomes unresponsive.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71329?
The severity of CVE-2025-71329 is classified as high with a score of 7.5.
How can I fix CVE-2025-71329?
To fix CVE-2025-71329, upgrade the image-size package to version 2.0.3 or later.
What type of vulnerability is CVE-2025-71329?
CVE-2025-71329 is a denial of service vulnerability caused by an infinite loop in the parser.
Which software is affected by CVE-2025-71329?
CVE-2025-71329 affects the npm package image-size version 2.0.2.
What can attackers achieve by exploiting CVE-2025-71329?
Attackers can exploit CVE-2025-71329 to indefinitely block the Node.js event loop, leading to service unavailability.