GHSA-w3rx-r6r6-pgpr

Suggest an improvement
Source
https://github.com/advisories/GHSA-w3rx-r6r6-pgpr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-w3rx-r6r6-pgpr/GHSA-w3rx-r6r6-pgpr.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-w3rx-r6r6-pgpr
Aliases
Downstream
CGA (8)
MINI (1)
Published
2026-06-10T15:31:30Z
Modified
2026-08-07T21:10:59Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
image-size: ICNS parser allows denial of service through an infinite loop
Details

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.

Database specific 
{
    "cwe_ids":  [
        "CWE-835"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-07T20:55:24Z",
    "nvd_published_at":  "2026-06-10T14:16:30Z",
    "severity":  "HIGH"
}
References

Affected packages

npm / image-size

Package

Name
image-size
View open source insights on deps.dev
Purl
pkg:npm/image-size

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
2.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-w3rx-r6r6-pgpr/GHSA-w3rx-r6r6-pgpr.json"