CVE-2025-71329
1 advisory.
npm/image-size CVE-2025-71329: high 7.5, EPSS 0.43%
image-size: JXL and HEIF parsers allow denial of service through infinite loops
Action: Upgrade image-size to 2.0.3 or later.
npm i image-size@2.0.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.2.0 | 2.0.3 | - |
Fixed versions
| 2.0.3 |
Sources
- osv: GHSA-5p2g-fcmc-qvqq
- https://nvd.nist.gov/vuln/detail/CVE-2025-71329
- https://codeberg.org/image-size/image-size/commit/e6e83a5578961de81f6d5834d90fb7430d8f29a5
- https://github.com/image-size/image-size
- https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities
- https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439
- https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser
CVE-2025-71329 · published · modified · JSON