image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.1.0, <= 1.2.1CPE matchmatch criteria | cpe:2.3:a:image-size:image-size:*:*:*:*:*:node.js:*:* | ||
>= 2.0.0, <= 2.0.2CPE matchmatch criteria | cpe:2.3:a:image-size:image-size:*:*:*:*:*:node.js:*:* | ||
2.0CPE matchmatch criteria | cpe:2.3:a:redhat:discovery:2.0:*:*:*:*:*:*:* | ||
3.0CPE matchmatch criteria | cpe:2.3:a:redhat:gatekeeper:3.0:*:*:*:*:*:*:* | ||
>= 1.4, < 1.4.2CPE matchmatch criteria | cpe:2.3:a:redhat:trusted_artifact_signer:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.