CVE-2025-71330
1 advisory.
npm/image-size CVE-2025-71330: high 7.5, EPSS 0.43%
image-size: ICNS parser allows denial of service through an infinite loop
Action: Upgrade image-size to 2.0.3 or later.
npm i image-size@2.0.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.6.3 | 2.0.3 | - |
Fixed versions
| 2.0.3 |
Sources
- osv: GHSA-w3rx-r6r6-pgpr
- https://nvd.nist.gov/vuln/detail/CVE-2025-71330
- https://codeberg.org/image-size/image-size/commit/e6e83a5578961de81f6d5834d90fb7430d8f29a5
- https://github.com/image-size/image-size
- https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities
- https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439
- https://www.vulncheck.com/advisories/image-size-denial-of-service-via-malformed-icns-image-parsing
CVE-2025-71330 · published · modified · JSON