image-size@2.0.0-beta.4

get dimensions of any image file

2.0.2

12 years ago

1 years ago

Known vulnerabilities in the image-size package. This does not include vulnerabilities belonging to this package’s dependencies.

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Vulnerability	Vulnerable Version
H Infinite loop Affected versions of this package are vulnerable to Infinite loop in `icns.js`. An ICNS file with an icon entry whose declared length is zero can hang the parser indefinitely. How to fix Infinite loop? There is no fixed version for `image-size`.	*
H Infinite loop Affected versions of this package are vulnerable to Infinite loop in the `extractPartialStreams()` and corresponding extraction functions for HEIF, JP2, and JXL. An attacker supplying an image whose requested box declares a size of zero can hang the parser indefinitely. Note: This is a bypass of the fix for the vulnerability described in CVE-2025-71319. How to fix Infinite loop? There is no fixed version for `image-size`.	*
H Infinite loop Affected versions of this package are vulnerable to Infinite loop in the `findBox()` function. An attacker can cause the application to hang indefinitely by supplying a malicious image. How to fix Infinite loop? Upgrade `image-size` to version 1.2.1, 2.0.2 or higher.	>=1.1.0 <1.2.1>=2.0.0-alpha.1 <2.0.2