Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2025-71329 Denial of Service in image-size Through 2.0.2 via Infinite Loop https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-71329
Post summary
The note announces CVE-2025-71329, a denial‑of‑service vulnerability in the image-size component through an infinite loop, but provides no PoC, exploit, or patch information.
CVE-2025-71329 image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially … https://www.cve.org/CVERecord?id=CVE-2025-71329
Post summary
The post announces a denial‑of‑service flaw in image‑size 2.0.2 that lets attackers permanently block the Node.js event loop.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | image-size | image-size | - | - | - |