fix(deps): update dependency image-size to v2 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
image-size	^1.2.1 → ^2.0.3

---

image-size: JXL and HEIF parsers allow denial of service through infinite loops

CVE-2025-71329 / GHSA-5p2g-fcmc-qvqq

More information

Details

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-71329
• https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities
• https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439
• https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser
• https://codeberg.org/image-size/image-size/commit/e6e83a5578961de81f6d5834d90fb7430d8f29a5
• https://github.com/advisories/GHSA-5p2g-fcmc-qvqq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

image-size: ICNS parser allows denial of service through an infinite loop

CVE-2025-71330 / GHSA-w3rx-r6r6-pgpr

More information

Details

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-71330
• https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities
• https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439
• https://www.vulncheck.com/advisories/image-size-denial-of-service-via-malformed-icns-image-parsing
• https://codeberg.org/image-size/image-size/commit/e6e83a5578961de81f6d5834d90fb7430d8f29a5
• https://github.com/advisories/GHSA-w3rx-r6r6-pgpr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

image-size/image-size (image-size)

v2.0.2

Compare Source

v2.0.1

Compare Source

v2.0.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.