npmPackage

image-size

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Version timeline

CVE-2025-71329
Affects 1.2.0 to 2.0.2 (2.0.3 is outside it)
CVE-2025-71330
Affects 0.6.3 to 2.0.2 (2.0.3 is outside it)
CVE-2025-71319
Affects 1.1.0 to 1.2.0 (1.2.1 is outside it); 2.0.0 to 2.0.1 (2.0.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2025-71329High 8.7
image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser
Affected: from 1.2.0, fixed in 2.0.3.
Fixed in 2.0.3 (released Sep 14, 2026, 96 days after disclosure).
The latest release, 2.1.0, is not affected.
50% of image-size downloads last week were affected versions (22.8M).
CVE-2025-71330High 8.7
image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing
Affected: from 0.6.3, fixed in 2.0.3.
Fixed in 2.0.3 (released Sep 14, 2026, 96 days after disclosure).
The latest release, 2.1.0, is not affected.
59% of image-size downloads last week were affected versions (26.7M).
CVE-2025-71319High 8.7
image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser
Affected: from 1.1.0, fixed in 1.2.1; from 2.0.0, fixed in 2.0.2.
Fixed in 1.2.1 (released Apr 2, 2025, 433 days before disclosure) and 2.0.2 (released Apr 2, 2025, 433 days before disclosure).
The latest release, 2.1.0, is not affected.
2.4% of image-size downloads last week were affected versions (1.1M).