These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A denial of service vulnerability exists in the image-size package through version 2.0.2. Remote attackers can exploit this vulnerability by supplying a specially crafted ICNS image buffer, which can cause the Node.js event loop to become permanently blocked. The vulnerability is triggered when the ICNS parser encounters an ICNS buffer with valid magic bytes and a zero-valued entry length field, resulting [truncated]
A denial of service vulnerability exists in image-size through version 2.0.2. Remote attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application. This issue affects Node.js applications using the image-size library, which may be exposed to denial of ser [truncated]
CVE-2025-71319 is a high-severity denial of service vulnerability in image-size through 2.0.2. Remote attackers can exploit this vulnerability by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type, causing an infinite loop in the JXL or HEIF image parsers and permanently blocking the Node.js event loop.