Security readout for executives and security teams
Plain-English summary
A malicious ICNS image can make a Node.js service using image-size stop processing work by locking the event loop. The business impact is availability: affected upload, scanning, proxy, or metadata services may hang until restarted or isolated.
Executive priority
Treat as a high-priority availability risk for internet-facing image workflows. Prioritize exposed upload and media-processing services first, then internal pipelines that process third-party content.
Technical view
image-size through 2.0.2 is reported vulnerable to CWE-835 in ICNS parsing. A malformed ICNS buffer with valid magic bytes and a zero entry length leaves the parser offset unchanged, causing an infinite loop and permanent Node.js event-loop blockage.
Likely exposure
Exposure is most likely in Node.js applications that run image-size against attacker-supplied images, remote URLs, uploads, attachments, or media metadata pipelines. Version evidence is inconsistent: the bundle says through 2.0.2, while affected entries list 1.1.0 and 2.0.0.
Exploitation context
The CVSS vector indicates network exploitation, low complexity, no privileges, no user interaction, and high availability impact. The bundle includes public technical details, but KEV is false and no cited source confirms active exploitation in the wild.
Researcher notes
Do not assume broad compromise: this is an availability flaw, not confidentiality or integrity impact in the cited CVSS. Exact affected-version boundaries need confirmation from vendor records because the provided data conflicts.
Mitigation direction
- Check image-size vendor guidance for the fixed or recommended version.
- Upgrade or replace vulnerable image-size deployments once a vendor-supported fix is confirmed.
- Avoid passing untrusted ICNS files or buffers to vulnerable parsing paths.
- Apply request isolation, worker timeouts, and restart supervision around image processing.
- Limit unauthenticated upload and remote-image ingestion where business requirements allow.
Validation and detection
- Inventory package-lock, yarn.lock, pnpm-lock, and SBOMs for image-size versions.
- Find services that parse uploaded, attached, proxied, or crawled images.
- Confirm whether ICNS inputs can reach image-size without trusted preprocessing.
- Review monitoring for event-loop stalls or hung image-processing workers.
- Track vendor advisory and CVE updates for version-specific correction details.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-835: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-71330 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://joshua.hu/image-size-infinite-loop-dos-vulnerabilitiesCVE reference, VulnCheck · technical-description, exploit
- https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439CVE reference, VulnCheck · issue-tracking
- https://www.vulncheck.com/advisories/image-size-denial-of-service-via-malformed-icns-image-parsingCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Loop with Unreachable Exit Condition ('Infinite Loop')
Loop with Unreachable Exit Condition ('Infinite Loop') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.