This might be a false positive, but package-lock.json around line 9272 looked worth a second pair of eyes.
The project uses image-size 0.5.5, which contains a DoS vulnerability (CVE‑2025‑71329). An attacker can supply a crafted JXL or HEIF image with a zero‑valued size field in a box header; the parser’s loop never advances, blocking the Node.js event loop and effectively hanging the application. This is a high‑severity issue because it can permanently deny service to legitimate users.
Something like this might fix it:
Upgrade the vulnerable `image-size` dependency to a version where the zero‑size box check is implemented (≥ 2.0.3). Replace the old version in `package.json` and regenerate `package-lock.json`.
```diff
--- a/package.json
+++ b/package.json
@@
- "image-size": "0.5.5",
+ "image-size": "^2.0.3",
```
After updating `package.json`, run `npm install` to produce an updated `package-lock.json` (the affected lines 9272‑9284 will show the new version and integrity hash). This eliminates the infinite‑loop bug and resolves CVE‑2025‑71329.
For reference: rule CVE-2025-71329. Rated high.
I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
This might be a false positive, but
package-lock.jsonaround line 9272 looked worth a second pair of eyes.The project uses image-size 0.5.5, which contains a DoS vulnerability (CVE‑2025‑71329). An attacker can supply a crafted JXL or HEIF image with a zero‑valued size field in a box header; the parser’s loop never advances, blocking the Node.js event loop and effectively hanging the application. This is a high‑severity issue because it can permanently deny service to legitimate users.
Something like this might fix it:
For reference: rule
CVE-2025-71329. Rated high.I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.