image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to     permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued     size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image     parsers by providing a crafted image containing a box with a size of zero, causing the offset to never     advance and permanently hanging the application. (CVE-2025-71319)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to
    permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued
    size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image
    parsers by providing a crafted image containing a box with a size of zero, causing the offset to never
    advance and permanently hanging the application. (CVE-2025-71319)

ID	Name	Product	Family	Severity
322362	Linux Distros Unpatched Vulnerability : CVE-2025-71319	Nessus	Misc.	high
423612	SCA: security update for image-size (GHSA-m5qc-5hw7-8vg7)	Tenable Cloud Security	SCA Checks	high
423612	SCA: security update for image-size (GHSA-m5qc-5hw7-8vg7)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2025-71319

high

Tenable Plugins

high

high

high