image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439 Issue Tracking, Patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.7 · image-sizeNVD modified 2026-10-12 22:10
Affected (CPE criteria) 1
cpe:2.3:a:image-size:image-size:*:*:*:*:*:*:*:*
References 3
- https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities Exploit, Third Party Advisory
- https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439 Issue Tracking, Patch
- https://www.vulncheck.com/advisories/image-size-denial-of-service-via-malformed-icns-image-parsing Third Party Advisory