CVE-2025-71330: image-size

csirt@kutim:~/threat-intel/cve/CVE-2025-71330

CVSS 7.5 · High EPSS 0,43%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada image-size. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.

Rincian

Terbit di NVD: 10 Juni 2026
Terakhir diubah: 12 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
EPSS (30 hari): 0,43% peluang dieksploitasi; lebih tinggi dari 35,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
image-size	image-size	Versi 1.1.0 hingga 1.2.1
image-size	image-size	Versi 2.0.0 hingga 2.0.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439 issue tracking · patch
https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities exploit · advisory pihak ketiga
https://www.vulncheck.com/advisories/image-size-denial-of-service-via-malformed-icns-image-parsing advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 13 Okt 2026, 12:25 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.