The vulnerability resides in the image-size library up to and including version 2.0.2. Attackers can permanently block the Node.js event loop by supplying a specially crafted image buffer that contains a zero-size box in the JXL or HEIF parser. The parser enters an infinite loop, never advancing the offset, thereby permanently hanging the application. This denial of service can be triggered remotely by uploading or feeding a malicious image and can affect any Node.js application that uses image-size for validation or parsing. The weakness is recorded as CWE-835, indicating an infinite loop.

The issue affects the image-size JavaScript library versions up to and including 2.0.2, meaning any releases before or equal to 2.0.2 are vulnerable. Applications that incorporate these releases—regardless of the Node.js runtime or environment—are at risk if they accept user-supplied images in the affected formats. No vendor-specific product names beyond the library itself were provided.

The CVSS score of 8.7 places this vulnerability in the high severity range, and the EPSS score of <1% indicates a low exploitation probability, although the nature of the flaw allows any attacker to craft a malicious image to trigger an infinite loop. The vulnerability is not listed in the CISA KEV catalog, but its impact is severe enough that systems can experience prolonged downtime if an attacker forces an application to become unresponsive. The likely attack vector is remote, applied through upload or ingestion of a malicious image; an attacker does not require privileged access or additional exploits to trigger the loop.