image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser
Priority HIGH 77CWE-835Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.
Summary
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00729 54th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Partial image-size (npm): 1.2.1, 2.0.2Red Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| image-size | image-size | 1.1.0 – 1.2.1; 2.0.0 – 2.0.2 | — | No fix listed | CNA |
| — | image-size (npm) | 1.1.0 to before 1.2.1 | 1.2.1 | Patch available | GHSA-m5qc-5hw7-8vg7 |
| — | image-size (npm) | 2.0.0 to before 2.0.2 | 2.0.2 | Patch available | GHSA-m5qc-5hw7-8vg7 |
- image-size Vendorimage-size Affected 1.1.0 – 1.2.1; 2.0.0 – 2.0.2 Fixed in — No fix listed CNA
- image-size (npm) Vendor— Affected 1.1.0 to before 1.2.1 Fixed in 1.2.1 Patch available GHSA-m5qc-5hw7-8vg7
- image-size (npm) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-m5qc-5hw7-8vg7
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:image-size:image-size:*:*:*:*:*:node.js:*:* | 1.1.0 – 1.2.1; 2.0.0 – 2.0.2 | Vulnerable | image-size |
| cpe:2.3:a:redhat:discovery:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:gatekeeper:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:trusted_artifact_signer:*:*:*:*:*:*:*:* | 1.4 to before 1.4.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
- cpe:2.3:a:image-size:image-size:*:*:*:*:*:node.js:*:* Versions 1.1.0 – 1.2.1; 2.0.0 – 2.0.2 Vulnerable ·image-size
- cpe:2.3:a:redhat:discovery:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:gatekeeper:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:trusted_artifact_signer:*:*:*:*:*:*:*:* Versions 1.4 to before 1.4.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-m5qc-5hw7-8vg7 image-size (npm) Fixed in 1.2.1 Advisory →
- Fix · GHSA-m5qc-5hw7-8vg7 image-size (npm) Fixed in 2.0.2 Advisory →
Red Hat 2 advisories
- RHSA-2026:37272 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
- RHSA-2026:33313 Released 2026-06-29 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Gatekeeper 3 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Discovery 2 | Fixed | RHSA-2026:33313 |
| Red Hat Trusted Artifact Signer 1.4 | Fixed | RHSA-2026:37272 |
Not affected: 12 products
- Red Hat Build of Podman Desktop
- Red Hat Discovery 2
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Fuse 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Dev Spaces
- Red Hat Satellite 6
- Red Hat Trusted Artifact Signer 1.4
Timeline
- 2026-10-02 Threatist record created from CVE-2025-71319
- 2026-10-03 Alias added: GHSA-m5qc-5hw7-8vg7
References
Advisory 6
- https://nvd.nist.gov/vuln/detail/CVE-2025-71319
- https://access.redhat.com/errata/RHSA-2026:33313
- https://access.redhat.com/errata/RHSA-2026:37272
- https://access.redhat.com/security/cve/CVE-2025-71319
- https://bugzilla.redhat.com/show_bug.cgi?id=2487296
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71319.json
More Image-size vulnerabilities
- TI-2025-43451 image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing CVSS 4.0HIGH 8.7
- TI-2025-43450 image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser CVSS 4.0HIGH 8.7
Sources
- CVE-2025-71319 · CVE Program
- CVE-2025-71319 · NVD
- FIRST EPSS
- GHSA-m5qc-5hw7-8vg7 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-71319 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences