Fluid Attacks Database

Description

A flaw was found in image-size. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying specially crafted JXL, HEIF, or JP2 image files that contain zero-sized boxes. The findBox function, responsible for image validation, enters an infinite loop when processing these malicious files, leading to an application hang. This can disrupt the availability of services relying on the image-size component.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	image-size	>=1.1.0 <1.2.1 \|\| >=2.0.0 <2.0.2	1.2.1, 2.0.2
rpm rhel8	subscription-manager	-	-

Aliases

1. CVE-2025-713192. NVD-2025-713193. OSV-2025-713194. GHSA-m5qc-5hw7-8vg75. GCVE-2025-71319

References

1. https://github.com/image-size/image-size/security/advisories/GHSA-m5qc-5hw7-8vg72. https://github.com/image-size/image-size/commit/8994131c7c3ee8da1699e04700c95e0e683a0c683. https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities4. https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/4395. https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.