CVE-2025-71319
EUVD-2025-21008709.06.2026, 21:17
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| image-size | image-size | 1.1.0 ≤ 𝑥 ≤ 1.2.1 |
| image-size | image-size | 2.0.0 ≤ 𝑥 ≤ 2.0.2 |
| redhat | discovery | 2.0 |
| redhat | gatekeeper | 3.0 |
| redhat | trusted_artifact_signer | 1.4 ≤ 𝑥 < 1.4.2 |
| redhat | enterprise_linux | 8.0 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Discovery 2 | 1782756541 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Trusted Artifact Signer 1.4 | 1783327185 ≤ 𝑥 < * | ADP |
Common Weakness Enumeration
References