[GHSA-5p2g-fcmc-qvqq] image-size: JXL and HEIF parsers allow denial of service through infinite loops

[wojtekmaj]

Updates

• Affected products
• CVSS v3
• Description

Comments
Please add a lower bound to the affected stable-version range: >= 1.2.0, <= 2.0.2. The current <= 2.0.2 range includes releases that do not contain the vulnerable parsers/loops. This is an introduced-version correction, not a claim that 1.2.1 or 2.0.2 fixes this advisory.

Evidence from published npm tarballs:

• 1.0.2 has neither a HEIF nor a JXL handler. Running the linked HEIF reproducer against 1.0.2 immediately throws unsupported file type.
• HEIF support appears in 1.1.0, but 1.1.0 and 1.1.1 only find a single ispe box and return its dimensions; they have no HEIF multi-image loop or JXL handler. The linked HEIF reproducer returns normally on both.
• 1.2.0 introduces dist/types/jxl.js and extractPartialStreams, whose offset = jxlpBox.offset + jxlpBox.size can fail to advance for a matching zero-size jxlp box. This remains in 1.2.1 and 2.0.2.
• The HEIF multi-image caller loop is present in 2.0.0 and 2.0.2; the linked HEIF reproducer hangs there. It returns normally in 1.2.0 and 1.2.1.
• I tested published parser modules in child processes with time/heap limits: the JXL case hangs or exhausts the bounded heap in 1.2.0, 1.2.1, 2.0.0 and 2.0.2.

Please distinguish this from GHSA-m5qc-5hw7-8vg7 / CVE-2025-71319, which covers the earlier zero-size loop inside findBox and already has a >= 1.1.0 lower bound. This advisory describes the remaining caller-side loops after findBox was changed to advance on nonmatching zero-size boxes.

Sources:
https://github.com/image-size/image-size/releases/tag/v1.1.0
https://github.com/image-size/image-size/releases/tag/v1.2.0
https://registry.npmjs.org/image-size/-/image-size-1.0.2.tgz
https://registry.npmjs.org/image-size/-/image-size-1.1.1.tgz
https://registry.npmjs.org/image-size/-/image-size-1.2.0.tgz
https://registry.npmjs.org/image-size/-/image-size-1.2.1.tgz
https://registry.npmjs.org/image-size/-/image-size-2.0.0.tgz
https://registry.npmjs.org/image-size/-/image-size-2.0.2.tgz
GHSA-m5qc-5hw7-8vg7

The proposed lower bound concerns stable releases; prerelease boundaries may need separate curator review.

[wojtekmaj]

The advisory improvement form unexpectedly removed the existing CVSS_V3 entry even though I did not change severity. Please preserve the original CVSS v3 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) alongside the unchanged CVSS v4 vector when curating this request. The intended change is only the affected-version lower bound and its explanatory description.

[Copilot]

🟡 Changes recommended

The valid CVSS v3 severity vector should not be removed as part of the version-range correction.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds the corrected lower bound for affected stable image-size releases and clarifies the distinct vulnerable parser loops.

Changes:

• Sets the affected range to 1.2.0–2.0.2.
• Clarifies JXL/HEIF version exposure and distinguishes CVE-2025-71319.
• Removes the CVSS v3 vector.

File summaries

File	Description
GHSA-5p2g-fcmc-qvqq.json	Updates affected versions, description, and severity metadata.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wojtekmaj]

Agreed. GitHub’s improvement form removed CVSS v3, and I can’t amend its generated branch. Please preserve the original severity data when reviewing.