CVE-2025-71330: image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
image-sizefrom your environment.Uninstall the image-size package or stop using its ICNS parsing functionality until a secure update is available. Versions through 2.0.2 are reported vulnerable.
- Compensating control
Do not accept or process ICNS images from untrusted sources. Run ICNS parsing in an isolated process/container with strict CPU and execution-time limits so a hung parser cannot permanently block the main Node.js event loop.
- Compensating control
Validate ICNS buffers before parsing and reject buffers that contain a zero-valued entry length field (the condition that can trigger an infinite loop in the parser).
- Operational
Search the codebase and dependency manifests for usages of image-size (including transitive dependencies). If found, remove or mitigate usage until a patched release is available. Restart any Node.js processes that become unresponsive due to ICNS parsing.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71330?
The severity of CVE-2025-71330 is rated as high with a score of 7.5.
What type of vulnerability is CVE-2025-71330?
CVE-2025-71330 is a denial of service vulnerability.
How does CVE-2025-71330 affect Node.js applications?
CVE-2025-71330 allows attackers to block the Node.js event loop by exploiting malformed ICNS image buffers.
Which version of image-size is affected by CVE-2025-71330?
CVE-2025-71330 affects image-size version 2.0.2.
How can I fix CVE-2025-71330?
To fix CVE-2025-71330, update the image-size package to a version that is not vulnerable.