Vulnerabilities |
3 via 3 paths |
|---|---|
Dependencies |
126 |
Source |
GitHub |
Find, fix and prevent vulnerabilities in your code.
high severity
- Vulnerable module: image-size
- Introduced through: image-size@1.2.1
Detailed paths
-
Introduced through: image-utilities@nitro404/image-utilities › image-size@1.2.1Remediation: Upgrade to image-size@2.0.3.
Overview
Affected versions of this package are vulnerable to Infinite loop in the extractPartialStreams() and corresponding extraction functions for HEIF, JP2, and JXL. An attacker supplying an image whose requested box declares a size of zero can hang the parser indefinitely.
Note: This is a bypass of the fix for the vulnerability described in CVE-2025-71319.
Remediation
Upgrade image-size to version 2.0.3 or higher.
References
high severity
- Vulnerable module: image-size
- Introduced through: image-size@1.2.1
Detailed paths
-
Introduced through: image-utilities@nitro404/image-utilities › image-size@1.2.1Remediation: Upgrade to image-size@2.0.3.
Overview
Affected versions of this package are vulnerable to Infinite loop in icns.js. An ICNS file with an icon entry whose declared length is zero can hang the parser indefinitely.
Remediation
Upgrade image-size to version 2.0.3 or higher.
References
medium severity
- Vulnerable module: file-type
- Introduced through: jimp@0.22.12
Detailed paths
-
Introduced through: image-utilities@nitro404/image-utilities › jimp@0.22.12 › @jimp/custom@0.22.12 › @jimp/core@0.22.12 › file-type@16.5.4
Overview
Affected versions of this package are vulnerable to Infinite loop in the FileTypeParser class. This is triggered when the ASF (WMV/WMA) parser receives input including an ASF sub-header with a size value of 0. An attacker can interrupt service with a 55-byte payload.
Remediation
Upgrade file-type to version 21.3.1 or higher.