image-size: ICNS parser allows denial of service through an infinite loop
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.
GHSA-w3rx-r6r6-pgpr
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-w3rx-r6r6-pgpr
image-size
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.0.3
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0.6.3"
},
{
"fixed": "2.0.3"
}
]
}
],
"package": {
"name": "image-size",
"purl": "pkg:npm/image-size",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-w3rx-r6r6-pgpr/GHSA-w3rx-r6r6-pgpr.json",
"last_known_affected_version_range": "<= 2.0.2"
}
}
]- Related CVEs
- CVE-2025-71330
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #14205 · Revision 1
- Added to Heist Feed
- Publisher date