CVE-2025-71329

[CVE catalog]

Severity

High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Jan 1, 2025, 12:00:00 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.43% · Oct 27, 2026

A flaw was found in image-size. A remote attacker can exploit this vulnerability by providing a specially crafted image buffer that contains a zero-valued size field within a recognized box-type. This malicious input can trigger an infinite loop in the JXL or HEIF image parsers, leading to a permanent block of the Node.js event loop. The consequence is a Denial of Service (DoS), causing the application to become unresponsive. image-size: image-size: Denial of Service via crafted image buffer with zero-valued size field A flaw was found in the image-size npm package. A crafted image buffer with a zero-valued size field in a recognized box-type (JXL or HEIF) can trigger an infinite loop, permanently blocking the Node.js event loop and causing a denial of service. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.