Go to packages list

image-size

Ecosystem: npm

Downloads: 132.06 Mln

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 3HighAffects 4 versions
  • 0MediumAffects 0 versions
  • 0ModerateAffects 0 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
3vulnerabilities
  • Critical0 (0.0%)
  • High3 (100.0%)
  • Medium0 (0.0%)
  • Moderate0 (0.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 2 vulnerabilities
    • Critical: 0
    • High: 2
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (3)

Known vulnerabilities affecting image-size, based on data from OSV.

Vulnerabilities affecting image-size
IDSeveritySummaryAffected versionsPublishedSource
GHSA-5p2g-fcmc-qvqqHighimage-size: JXL and HEIF parsers allow denial of service through infinite loopsimage-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.
  • >= 1.2.0, < 2.0.3
GitHub (opens in a new tab)
GHSA-w3rx-r6r6-pgprHighimage-size: ICNS parser allows denial of service through an infinite loopimage-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.
  • >= 0.6.3, < 2.0.3
GitHub (opens in a new tab)
GHSA-m5qc-5hw7-8vg7Highimage-size Denial of Service via Infinite Loop during Image Processing### Summary `image-size` is vulnerable to a Denial of Service vulnerability when processing specially crafted images. The issue occurs because of an infine loop in `findBox` when processing certain images with a box with size `0`. ### Details If the first bytes of the input does not match any bytes in `firstBytes`, then the package tries to validate the image using other handlers: ```js // https://github.com/image-size/image-size/blob/v1.2.0/lib/detector.ts#L20-L31 export function detector(input: Uint8Array): imageType | undefined { const byte = input[0] if (byte in firstBytes) {
  • >= 1.1.0, < 1.2.1
  • >= 2.0.0, < 2.0.2
GitHub (opens in a new tab)
  • GHSA-5p2g-fcmc-qvqqHigh
    image-size: JXL and HEIF parsers allow denial of service through infinite loops
    • >= 1.2.0, < 2.0.3
    GitHub (opens in a new tab)

    image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.

    CVE: CVE-2025-71329

  • GHSA-w3rx-r6r6-pgprHigh
    image-size: ICNS parser allows denial of service through an infinite loop
    • >= 0.6.3, < 2.0.3
    GitHub (opens in a new tab)

    image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.

    CVE: CVE-2025-71330

  • GHSA-m5qc-5hw7-8vg7High
    image-size Denial of Service via Infinite Loop during Image Processing
    • >= 1.1.0, < 1.2.1
    • >= 2.0.0, < 2.0.2
    GitHub (opens in a new tab)

    ### Summary `image-size` is vulnerable to a Denial of Service vulnerability when processing specially crafted images. The issue occurs because of an infine loop in `findBox` when processing certain images with a box with size `0`. ### Details If the first bytes of the input does not match any bytes in `firstBytes`, then the package tries to validate the image using other handlers: ```js // https://github.com/image-size/image-size/blob/v1.2.0/lib/detector.ts#L20-L31 export function detector(input: Uint8Array): imageType | undefined { const byte = input[0] if (byte in firstBytes) {

    CVE: CVE-2025-71319

Showing 1-3 of 3 vulnerabilities