image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.
Fix
Public exploits 1
- lcf2212dev/image-size-next PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 1
- https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439 Issue Tracking, Patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.7 · image-sizeNVD modified 2026-10-12 22:10
Affected (CPE criteria) 1
cpe:2.3:a:image-size:image-size:*:*:*:*:*:*:*:*
References 3
- https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities Exploit, Third Party Advisory
- https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439 Issue Tracking, Patch
- https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser Third Party Advisory