CVE-2025-71329 image-size CVE debrief

Who should care

Defenders responsible for Node.js applications using the image-size library should assess exposure and prioritize verification and updates to prevent potential denial of service attacks.

Why it matters

CVE-2025-71329 is a denial of service vulnerability in image-size that allows remote attackers to permanently block the Node.js event loop. Defenders should prioritize verification, updates, and exposure assessment to prevent potential attacks.

• Denial of service attacks can permanently block the Node.js event loop
• Defenders must verify and update image-size to a non-vulnerable version
• Exposure assessment is crucial for Node.js applications using image-size

Technical summary

The image-size library through version 2.0.2 contains a denial of service vulnerability. An attacker can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application. This vulnerability allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Defenders should prioritize verifying and updating image-size to a non-vulnerable version, assessing exposure in Node.js applications, and monitoring for potential exploitation attempts.

Defensive priority

Defenders should prioritize verifying and updating image-size to a non-vulnerable version, assessing exposure in Node.js applications, and monitoring for potential exploitation attempts.

Recommended defensive actions

• Verify and update image-size to a non-vulnerable version
• Assess exposure in Node.js applications
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and NVD entry provide details on the denial of service vulnerability in image-size. The vulnerability allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.