CVE-2025-71330: Denial of Service in image-size ICNS Parser

Technical summary

The vulnerability exists in the ICNS image format parser within image-size. The parser uses a while loop to iterate through ICNS directory entries, incrementing an offset variable with each iteration. When an attacker supplies an entry with a zero-valued length field, the offset is never advanced (since the length is zero), and the loop condition remains perpetually satisfied. This causes the parser thread to consume 100% CPU and never yield control back to the Node.js event loop, effectively denying service to the entire application. The flaw is classified as an infinite loop (CWE-835) resulting in resource exhaustion.

Business impact

Applications that use image-size to process user-supplied or untrusted ICNS images face immediate availability risk. A single malicious ICNS upload can hang worker processes or entire services. Organizations hosting image processing pipelines, CDN services, or user file upload features are particularly exposed. The impact is service degradation or outage rather than data loss or unauthorized access, but availability failures directly affect SLA compliance and customer trust. Downstream users of image-size who incorporate it into security scanning or validation workflows may also experience cascading failures.

Affected systems

The image-size npm package version 2.0.2 and earlier are affected. This includes any Node.js application or microservice that imports image-size and calls its functions on ICNS image buffers without pre-validation. Web frameworks, content management systems, media processing tools, and cloud-based image hosting solutions that depend on image-size are in scope. Verify your dependency tree; image-size may be a transitive dependency of another package you use.

Exploitability

Exploitation is straightforward and requires no credentials or special privileges. An attacker only needs to craft and deliver a malicious ICNS file to an application endpoint that processes images. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects that the attack is network-accessible, has low complexity, requires no privileges, and does not depend on user interaction. However, exploitation is conditional on the application actually parsing ICNS files; applications that ignore ICNS or reject untrusted image formats are unaffected.

Remediation

Upgrade image-size to a version that includes the fix. Verify the patch version number in the project's release notes or GitHub repository, as stable patches are expected to be published. Alternatively, implement strict input validation upstream: reject or sandbox ICNS files if they are not essential to your use case, apply file-type whitelisting, and consider isolating image processing in separate worker processes with timeout guards. Rate-limiting on file uploads can reduce attack surface.

Patch guidance

Monitor the image-size project repository and npm package for a patched release beyond version 2.0.2. When available, update via npm update or npm install image-size@latest and run your test suite to confirm compatibility. If you maintain a lock file, regenerate it after updating. If you are a downstream maintainer of a package that depends on image-size, prioritize this update and release a new version that pins a safe version of image-size.

Detection guidance

Monitor for sudden CPU spikes or event loop lag in Node.js processes handling image uploads. Application performance monitoring tools should flag process hang events. In logs, look for ICNS parsing initiation followed by process unresponsiveness. Implement timeout guards around image processing calls. Network-level detection is challenging without deep packet inspection, but rate-limiting unusual or repeated failed image upload attempts may catch opportunistic attacks. Intrusion detection systems tuned for DoS patterns may identify multiple malicious ICNS submissions.

Why prioritize this

Although this vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, the high CVSS score (7.5) and trivial exploitation complexity warrant urgent patching, especially for publicly exposed image processing services. The DoS vector is straightforward and requires minimal attacker resources. Organizations with high-availability requirements or those accepting user-supplied images should prioritize this within 7–14 days.

Risk score, explained

The CVSS:3.1 score of 7.5 reflects high severity due to the availability impact (A:H), network accessibility (AV:N), and low attack complexity (AC:L). No confidentiality or integrity impact exists (C:N/I:N), limiting the score to the high range. The lack of authentication (PR:N) and no user interaction requirement (UI:N) make this remotely exploitable by any attacker. Organizations should treat a 7.5 HIGH vulnerability as a significant risk, especially when the attack vector is straightforward and the defending action (upgrade) is low-risk.

Frequently asked questions