CVE-2025-71319

image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser

publishedCWE-835

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.

Technical severity8.7 highCVSS 4.0 · CNA: VulnCheck

Published2026-06-09Source updated 2026-11-08

Collected2026-11-082 attributed sources

Fixes and workarounds

Fix

RHSA-2026:33313: Red Hat Discovery 2 RHSA-2026:37272: Red Hat Trusted Artifact Signer 1.4

Source: ADP: redhat-SADP

Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Source: ADP: redhat-SADP

Fix

The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.

Source: CNA: VulnCheck

Affected products and versions

Affected products, source version ranges and reporting authorities
Product	Versions	Authority
image-size image-size `image-size` npm	≥ 1.1.0; ≤ 1.2.1 (affected, semver) ≥ 2.0.0; ≤ 2.0.2 (affected, semver) Other versions: unaffected	CNA: VulnCheck
Red Hat Discovery 2 Red Hat `discovery/discovery-ui-rhel9` https://catalog.redhat.com/software/containers/	≥ 1782756541; < * (unaffected, rpm) Other versions: affected	ADP: redhat-SADP
Red Hat Trusted Artifact Signer 1.4 Red Hat `rhtas/rekor-search-ui-rhel9` https://catalog.redhat.com/software/containers/	≥ 1783327185; < * (unaffected, rpm) Other versions: affected	ADP: redhat-SADP
Gatekeeper 3 Red Hat `gatekeeper/gatekeeper-rhel9` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: affected	ADP: redhat-SADP
Red Hat Build of Podman Desktop Red Hat `rh-podman-desktop.git` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: unaffected	ADP: redhat-SADP
Red Hat Enterprise Linux 7 Red Hat `subscription-manager` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: unaffected	ADP: redhat-SADP
Red Hat Enterprise Linux 8 Red Hat `grafana` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: unaffected	ADP: redhat-SADP
Red Hat Enterprise Linux 8 Red Hat `grafana-pcp` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: unaffected	ADP: redhat-SADP
Red Hat Enterprise Linux 8 Red Hat `subscription-manager` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: affected	ADP: redhat-SADP
Red Hat Fuse 7 Red Hat `image-size` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: unaffected	ADP: redhat-SADP
Red Hat JBoss Enterprise Application Platform 7 Red Hat `image-size` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: unaffected	ADP: redhat-SADP
Red Hat JBoss Enterprise Application Platform 8 Red Hat `image-size` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: unaffected	ADP: redhat-SADP
Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat `image-size` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: unaffected	ADP: redhat-SADP
Red Hat OpenShift AI (RHOAI) Red Hat `rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: unaffected	ADP: redhat-SADP
Red Hat OpenShift Dev Spaces Red Hat `devspaces/code-rhel9` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: unaffected	ADP: redhat-SADP
Red Hat Satellite 6 Red Hat `satellite/iop-vulnerability-frontend-rhel9` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: unaffected	ADP: redhat-SADP

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
4.0 / 8.7 high	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`	CNA: VulnCheck
3.1 / 7.5 high	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`	CNA: VulnCheck
3.1 / 7.5 high	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`	ADP: redhat-SADP

Exploit evidence

https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities
exploit · CNA: VulnCheck

References

https://joshua.hu/image-size-infinite-loop-dos-vulnerabilitiesCNA: VulnCheck · technical-description, exploit
https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439CNA: VulnCheck · issue-tracking, patch
https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parserCNA: VulnCheck · third-party-advisory
https://access.redhat.com/security/cve/CVE-2025-71319ADP: redhat-SADP · vdb-entry, x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2487296ADP: redhat-SADP · issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71319.jsonADP: redhat-SADP · x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:33313ADP: redhat-SADP · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:37272ADP: redhat-SADP · vendor-advisory, x_refsource_REDHAT

For agents and automation

Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.

Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.

Get an API key Use x402 Connect an agent

Endpoints and access details

https://api.y2.dev/api/v2/cyber/cves
https://api.y2.dev/api/v2/cyber/cves/{cveId}

A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.

For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.

Agent access JSON · OpenAPI · CVE API guide