Vulnerabilities

 2 via 2 paths

Dependencies

 24

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 2
Status
  • 2
  • 0
  • 0

high severity
new

Infinite loop

  • Vulnerable module: image-size
  • Introduced through: svgdom@0.1.23

Detailed paths

  • Introduced through: svguitar@omnibrain/svguitar › svgdom@0.1.23 › image-size@1.2.1

Overview

Affected versions of this package are vulnerable to Infinite loop in the extractPartialStreams() and corresponding extraction functions for HEIF, JP2, and JXL. An attacker supplying an image whose requested box declares a size of zero can hang the parser indefinitely.

Note: This is a bypass of the fix for the vulnerability described in CVE-2025-71319.

Remediation

There is no fixed version for image-size.

References

Infinite loop vulnerability report

high severity
new

Infinite loop

  • Vulnerable module: image-size
  • Introduced through: svgdom@0.1.23

Detailed paths

  • Introduced through: svguitar@omnibrain/svguitar › svgdom@0.1.23 › image-size@1.2.1

Overview

Affected versions of this package are vulnerable to Infinite loop in icns.js. An ICNS file with an icon entry whose declared length is zero can hang the parser indefinitely.

Remediation

There is no fixed version for image-size.

References

Infinite loop vulnerability report