ROOT-APP-NPM-CVE-2025-71330 CVE-2025-71330 in image-size - Patched by Root

Root has patched CVE-2025-71330 in the image-size package for Root:npm. Multiple fixed versions available...

0xuath-sdk-react (>=0.0.2, <=0.0.23), 11ty-tools (>=1.0.0-alpha.1, <=2.0.0) +13907 more potentially affected by CVE-2025-71330 via image-size (>=0.6.3, <=2.0.2)

image-size NPM version =0.6.3, =0.0.2, =1.0.0-alpha.1, =1.0.5, =1.0.0, =1.0.0, =1.0.0, =1.0.21, =1.0.2, =0.0.1, =1.0.3, =0.0.2, =0.0.1, =4.11.0, =0.1.1, =0.0.1-251008.90016, =0.3.0 and more Source cves: CVE-2025-71330 Source advisory: OSV:GHSA-W3RX-R6R6-PGPR...

org.webjars.npm:datauri (>=1.1.0, <=2.0.0), org.webjars.npm:image-thumbnail (1.0.15) +1 more potentially affected by CVE-2025-71330 via org.webjars.npm:image-size (>=0.5.5, <=2.0.0-alpha.1)

org.webjars.npm:image-size MAVEN version =0.5.5, =1.1.0, =2.7.1, =2.7.2 Source cves: CVE-2025-71330 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17295817...

02vue_toast_demo (>=1.0.1, <=1.0.4), 06-tekbooks (0.1.0) +30558 more potentially affected by CVE-2025-71330 via image-size (>=0.0.16, <=2.0.4)

image-size NPM version =0.0.16, =1.0.1, =0.0.2, =0.0.3, =1.0.0-alpha.1, =1.0.5, =5.0.0, =2.3.0, =2.0.0, =1.0.0, =1.0.0, =1.3.3 and more Source cves: CVE-2025-71330 Source advisory: SNYK:JS-IMAGESIZE-17295816...

CVE-2025-71330 image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to...