CVE-2025-71330 image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing
Remote attackers can cause a permanent denial of service in Node.js applications by supplying a malformed ICNS image that triggers an infinite loop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71330?
CVE-2025-71330 is a high-severity denial of service vulnerability in image-size, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.
Weakness: CWE-835
Which versions are affected by CVE-2025-71330?
2 open source packages ship an affected version, including image-size. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
image-size npm | From 0.6.3 | 2.0.3 |
image-size npm | From 0.6.3 | 2.0.3 |
Products include Image-Size Image-Size.
How do I fix CVE-2025-71330?
Upgrade image-size to 2.0.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-71330 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-71330 exists.
Other vulnerabilities in image-size
Sources
Also known as CLSA-2026-1792743661, CLSA-2026-1792743831, GHSA-w3rx-r6r6-pgpr, MINI-5g27-998v-3p2x, MINI-9f27-q9qf-77cm, MINI-gxg7-q37f-6xf5 and 1 more.