EUVD-2025-210087
GHSA-m5qc-5hw7-8vg7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify endpoint that processes uploaded images
-
DeliveryCraft 8-byte file with JXL/HEIF/JP2 box size zero
-
ExploitSubmit file via upload or fetch endpoint
-
Installimage-size detector dispatches to vulnerable handler
-
C2findBox enters infinite loop, pinning worker
-
ExecuteRepeat to exhaust worker pool
-
ImpactService becomes unavailable
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target application pass attacker-controlled bytes to image-size's detector - typically any file upload, URL-fetched image, or media-processing pipeline using the vulnerable 1.1.0-1.2.0 or 2.0.0-2.0.1 versions. No authentication is required by the library itself (CVSS PR:N), no user interaction, and no special image-size configuration; the default code path through detector() reaches findBox on any input whose first byte does not match the firstBytes table and whose bytes 4-8 form 'JXL ', 'ftyp' for HEIF, or the JP2 signature. Limiting factors are deployment-level rather than library-level: callers that already wrap image-size in a timeout, a subprocess, or a sandbox with CPU limits will see degraded availability for that worker rather than full process hang, and services that strictly whitelist content types before invoking image-size may not reach the vulnerable handlers. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VA:H and no confidentiality or integrity impact accurately reflects a pure availability bug reachable by any remote caller that can submit an image. EPSS and CISA KEV data were not provided, so there is no confirmed evidence of in-the-wild exploitation, but the GHSA advisory publishes enough detail (including payload construction guidance) that a working POC is trivial to derive, which should be treated as effectively public. Real-world risk is concentrated in services that accept user-supplied images and call image-size synchronously on the request thread - there a single malicious upload pins a worker indefinitely, and repeated uploads exhaust the worker pool. For services that run image-size in isolated subprocesses with timeouts the practical impact is lower, so prioritization should follow how the library is invoked rather than the headline 8.7 score. |
| Exploit ScenarioDerived | An attacker uploads an 8-byte file whose bytes at offsets 4-8 spell 'JXL ' (or the analogous HEIF/JP2 ftyp marker) and whose remaining bytes are zero to any endpoint that detects image metadata using image-size, such as an avatar upload, a CMS media library, or a chat attachment handler. The request thread enters an infinite loop inside findBox and never returns, and by submitting one such request per worker the attacker exhausts the Node.js process pool and takes the service offline. The advisory publishes the payload structure, so while no standalone POC is linked, weaponization is a few lines of code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 09, 2026
Denial of service in the npm image-size library (versions 1.1.0-1.2.0 and 2.0.0-2.0.1) lets remote unauthenticated attackers hang any application that parses untrusted JXL, HEIF, or JP2 images. By supplying a crafted file whose ISO-BMFF-style box declares a size of zero, the findBox routine never advances its offset and enters an infinite loop during validation. No public exploit identified at time of analysis, though the vendor advisory includes payload details that make weaponization straightforward.
Earlier versions of this analysis (2)
Denial of service in the npm image-size library (versions 1.1.0-1.2.0 and 2.0.0-2.0.1) allows remote unauthenticated attackers to hang any application that parses untrusted images. A specially crafted JXL, HEIF, or JP2 file with a zero-sized box triggers an infinite loop inside the findBox routine during validation. No public exploit identified at time of analysis, but the GHSA advisory includes a detailed root-cause walkthrough that effectively serves as exploitation guidance.
Denial of service in the image-size npm package (versions 1.1.0 to 1.2.0 and 2.0.0 to 2.0.1) allows remote attackers to hang Node.js applications by submitting crafted JXL, HEIF, or JP2 images containing a box with size zero, which triggers an infinite loop inside the findBox parsing routine. The CVSS 7.5 score reflects high availability impact with no authentication required, though no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Any web service, CMS, or pipeline that calls image-size on user-supplied images is at risk of resource exhaustion.
RemediationAI
Upgrade image-size to vendor-released patch version 1.2.1 on the 1.x branch or 2.0.2 on the 2.x branch, both of which contain commit 8994131c7c3ee8da1699e04700c95e0e683a0c68 that fixes the findBox loop; consult https://github.com/image-size/image-size/security/advisories/GHSA-m5qc-5hw7-8vg7 for the authoritative advisory. Run npm audit fix or update package-lock.json and any transitive pins (image-size is commonly pulled in by image-processing middleware), and rebuild containers so the patched version is actually loaded. If immediate upgrade is not possible, compensating controls include invoking image-size inside a worker thread or child process with a hard wall-clock timeout (sub-second is sufficient because legitimate detection is microsecond-scale), rejecting uploads whose first 8 bytes match the JXL/HEIF/JP2 ftyp signatures at the edge until patched, or limiting upload size - note the size limit only narrows the attack surface because a malicious file can be as small as 8 bytes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
image-size is a widely deployed npm package for detecting image dimensions and type from raw bytes, frequently embedded in web upload pipelines, thumbnailers, and image-processing middleware. The flaw lives in lib/types/utils.ts in the readBox/findBox helpers used by the JXL, HEIF, and JP2 type handlers, which iterate through ISO base media file format boxes by reading a 32-bit big-endian size field and adding it to the current offset. When boxSize is 0 the bounds check (input.length - offset < boxSize) is satisfied and offset is never incremented, producing the CWE-835 'Loop with Unreachable Exit Condition' infinite loop. Because the detector falls through to these handlers whenever the first byte does not match a known signature, an attacker only needs the bytes at offsets 4-8 to spell 'JXL ' (or the equivalent HEIF/JP2 markers) to reach the vulnerable path.
Know when Image Size gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
image-size 1.1.0 before 1.2.1 and 2.0.0 before 2.0.2 contain a denial of service vulnerability in the findBox function when processing specially crafted images with zero-sized boxes. Remote attackers can cause application hang by supplying malicious JXL, HEIF, or JP2 image files with box size zero, triggering infinite loops during image validation.
Blast Radius
ecosystem impact- 4 npm packages depend on image-size (3 direct, 1 indirect)
Ecosystem-wide dependent count for version 1.1.0.
Executive ViewAI
The npm image-size library (versions 1.1.0-1.2.0 and 2.0.0-2.0.1) contains a denial-of-service vulnerability allowing remote attackers to hang applications that parse untrusted JXL, HEIF, or JP2 image files, potentially disrupting any service relying on this library for image validation or metadata extraction. Organizations using vulnerable versions face service downtime whenever user-supplied or externally-sourced images are processed. The absence of a vendor patch requires immediate interim controls to mitigate risk.
Since no vendor-released patch identified at time of analysis, implement interim mitigations: (1) strict input validation-reject or sandbox image files from untrusted sources before image-size processing; (2) timeout mechanisms on image parsing operations to fail fast and prevent hangs; (3) restrict image-size usage to internal and pre-validated image sources only; (4) apply OS-level resource limits (CPU time, memory) on image processing processes to contain impact; (5) disable JXL, HEIF, and JP2 format support in applications that do not require these formats; (6) isolate image processing in containerized or sandboxed environments to prevent cascading service failures; (7) deploy network-level controls (WAF, firewall rules) to block requests with malformed image headers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Image Size
View allDenial of service in the image-size Node.js library through version 2.0.2 allows remote unauthenticated attackers to per
Denial of service in the image-size Node.js library (versions up to and including 2.0.2) allows remote unauthenticated a
Exploit-DB