The vulnerability is an infinite loop caused by parsing an ICNS image buffer that contains a zero‑valued entry length field. When the image-size library (v2.0.2 and earlier) reads such a buffer, the offset never advances, the while‑loop condition stays true, and the Node.js event loop is permanently blocked. The result is a complete denial of service to any application that imports the affected library and processes the malformed image.

Any Node.js application that depends on the image-size package version 2.0.2 or earlier is susceptible. The library propagates through any project that imports it, exposing all environments that run the Node.js code to the risk.

The CVSS v3.1 score of 8.7 reflects the high severity of the denial of service. EPSS data is unavailable and the vulnerability is not currently listed in the CISA KEV catalog. Attackers can remotely exploit the flaw by delivering a specially crafted ICNS buffer—typically via a file upload, API payload, or embedded data—to a running application that uses image-size. The lack of checks on the entry length makes the flaw trivially exploitable for anyone who can influence the input.