This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2025-71329 | BDVDB-2026-339408 Detail

image-sizeimage-size

Description#

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.

Impact#

Per CVSS v3.1: confidentiality impact none, integrity impact none, availability impact high. Attack vector: network.

Weaknesses#

  • CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

References#

Exploit#

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.