image-size through 2.0.2 has a remote denial of service vulnerability that allows attackers to block the Node.js event loop indefinitely. By sending a crafted image buffer that contains a box with a zero‑valued size field in the JXL or HEIF format, the parser enters an infinite loop that never advances the offset pointer, effectively hanging the application for the remainder of its lifetime. The weakness is an uncontrolled loop (CWE‑835) and can compromise availability for any service that uses image-size for image processing.

The affected product is the image-size library, version 2.0.2 and earlier. Any Node.js application that imports the library for parsing JXL or HEIF images can be impacted.

The CVSS score of 8.7 indicates a high impact denial of service scenario. No EPSS value is provided and the vulnerability is not listed in the CISA KEV catalog, but the lack of an exploitation probability score does not negate the risk of immediate exploitation because the attacker only needs to supply a specially crafted image via the application’s normal image processing path. Since the vulnerable code executes in the main event loop of Node.js, the exploit does not require elevated privileges and can be triggered simply by any request that results in the parser being invoked.