Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2025-71330 Denial of Service in image-size Through 2.0.2 via Malformed ICNS Buffer https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-71330
Post summary
The entry announces CVE‑2025‑71330, a denial‑of‑service vulnerability in image‑size through v2.0.2 triggered by malformed ICNS buffers, with details linked to Vulmon.
CVE-2025-71330 image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially … https://www.cve.org/CVERecord?id=CVE-2025-71330
Post summary
The passage summarizes CVE-2025-71330 as a denial‑of‑service flaw in the image-size library that can permanently block the Node.js event loop when supplied with malicious input.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | image-size | image-size | - | - | - |