Security readout for executives and security teams
Plain-English summary
A crafted image can make applications using image-size hang indefinitely. The business impact is availability: affected Node.js services that inspect untrusted JXL or HEIF images may stop responding until restarted or isolated.
Executive priority
Treat as high priority for internet-facing upload or image-processing services. The issue is not data theft, but a simple unauthenticated availability failure can disrupt customer workflows and require operational intervention.
Technical view
CVE-2025-71329 is a CWE-835 infinite-loop flaw in image-size through 2.0.2. A zero-valued box size in recognized JXL or HEIF parser input can prevent offset advancement, permanently blocking the Node.js event loop and causing denial of service.
Likely exposure
Highest exposure is in Node.js applications that run image-size on user-supplied uploads, URLs, attachments, or API-provided image buffers, especially where JXL or HEIF input is accepted.
Exploitation context
The bundle cites a public technical write-up and exploit-tagged reference, but does not state known active exploitation. CVE data lists network, low-complexity, unauthenticated exploitation with high availability impact.
Researcher notes
Evidence is strong for the bug class and impact, but the bundle has version ambiguity: the description says through 2.0.2, while affected entries list 1.1.0 and 2.0.0. Verify exact package range against vendor records.
Mitigation direction
- Check image-size vendor guidance and releases for a fixed version before upgrading.
- Restrict or reject untrusted JXL and HEIF inputs if not business-required.
- Run image metadata parsing in an isolated worker or process that can be terminated.
- Apply upload size, type, and queue limits around image inspection endpoints.
- Monitor affected services for repeated hangs or forced restarts after image submissions.
Validation and detection
- Inventory applications and lockfiles for image-size versions through 2.0.2.
- Identify code paths that pass untrusted buffers, uploads, or remote images into image-size.
- Confirm whether JXL or HEIF files are accepted by public or partner-facing endpoints.
- Review dependency advisories and vendor issue tracking for fix status and affected version clarity.
- Test remediation in staging with benign malformed-file regression cases only.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-835: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-71329 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://joshua.hu/image-size-infinite-loop-dos-vulnerabilitiesCVE reference, VulnCheck · technical-description, exploit
- https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439CVE reference, VulnCheck · issue-tracking
- https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parserCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Loop with Unreachable Exit Condition ('Infinite Loop')
Loop with Unreachable Exit Condition ('Infinite Loop') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.