image-size EUVD-2025-210105

The target application must invoke the image-size library (version <= 2.0.2) on attacker-controlled bytes and must not pre-filter the ICNS container format - typical exposures include avatar uploaders, image-metadata endpoints, OG-image scrapers, and any HTTP handler that passes request bodies through image-size for dimension detection. No authentication, user interaction, or non-default configuration is required (CVSS 4.0 PR:N/UI:N/AT:N), but the attacker must be able to deliver a buffer to a code path that calls the ICNS parser; pure client-side or build-time uses of image-size on trusted assets are not exploitable. The DoS is per-process and persistent until the Node.js worker is restarted, so deployments behind multi-worker process managers (PM2, cluster mode, Kubernetes) limit blast radius to whichever worker handled the malicious request.

CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N rates this 8.7 (High) on the basis of high availability impact (VA:H) with no confidentiality or integrity impact and no privileges, user interaction, or attack requirements - a clean, easily reachable network DoS. Public exploit code is confirmed (VulnCheck advisory plus a researcher write-up at joshua.hu), and an upstream patch (PR #439) is available, raising the practical risk for any service that accepts user-supplied images and runs them through image-size. Real-world risk is elevated for SaaS image processors, avatar uploaders, and any Node.js server-side rendering pipeline that calls image-size on untrusted input; conversely, build-time or CLI-only uses of image-size are largely unaffected. EPSS and CISA KEV status are not provided in the input, so widespread mass-exploitation prevalence cannot be confirmed - but because Node.js event-loop blocking takes down the entire process with a single small request, defenders should treat exploitation as cheap and reliable once the POC is republished.

An attacker uploads or submits a small ICNS image - for instance, as a user avatar, OG-image preview, or webhook payload - to a Node.js service that calls image-size on incoming files. The crafted file contains the valid 'icns' magic header followed by an entry whose declared length is zero, causing image-size's ICNS parser to enter an infinite loop on the first parse. The Node.js event loop blocks indefinitely, hanging the entire process and denying service to every other client of that worker; a public POC and write-up at joshua.hu document the exact byte layout.