image-size CVE-2025-71329

The target application must call image-size (≤ 2.0.2) on attacker-controlled bytes and have its JXL or HEIF parsing code paths reachable - these parsers are invoked based on the image's container signature, so simply accepting arbitrary image uploads is sufficient and no special configuration toggle is required. No authentication is required (PR:N), no user interaction is required (UI:N), and the attack works against default configurations over the network (AV:N/AC:L). Limiting factors: the application must actually invoke image-size on untrusted input (build-time-only or trusted-source usage is not exposed), and impact is bounded to availability - confidentiality and integrity are unaffected (VC:N/VI:N) - so deployments running image-size in a sandboxed worker with timeouts will see degraded rather than catastrophic impact.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VA:H produces a score of 8.7 (High) and accurately reflects an unauthenticated, low-complexity, network-reachable availability attack with high availability impact and no confidentiality or integrity impact - consistent with a pure DoS. SSVC signals are not provided, but the combination of public POC, a merged upstream fix, and the trivial payload (a single malformed image) make exploitation Automatable=Yes and Technical Impact=Partial in practical terms. No EPSS score is supplied and the CVE is not in CISA KEV, so there is no evidence of in-the-wild abuse yet; however, image-size is a transitive dependency in many image-processing pipelines, upload handlers, and SSR frameworks, so the realistic blast radius is broader than the CVSS alone implies. Priority should be elevated for any internet-facing service that calls image-size on attacker-controlled bytes, and treated as lower priority for build-time-only or trusted-input usage.

An attacker uploads or submits a single crafted JXL or HEIF image - a few hundred bytes is enough - to any endpoint that passes user-supplied image bytes to image-size, for example an avatar upload, a thumbnail generator, or an SSR meta-tag image probe. The malformed box with size=0 sends the parser into an infinite loop on the Node.js main thread, blocking all concurrent requests handled by that worker until it is killed; with publicly available exploit code, repeating this across worker processes trivially takes the service offline.