Security: vulnerable dependency image-size (CVE-2025-71329/71330) — maintained drop-in available
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 52/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- javascript
- Domain
- security
Research direction
Start by locating appdmg-tf's dependency manifest and checking whether image-size is used directly or transitively. Compare the existing usage with image-size-next@2.1.0, choose the direct dependency or npm override path, and verify that the package continues to build and behave as before.
Written by the indexing model from the issue text.
Description
Context
This package depends on npm image-size. Upstream is archived and the latest release (2.0.2) remains affected by:
- CVE-2025-71329 — DoS via infinite loop (JXL/HEIF/JP2 zero-size boxes)
- CVE-2025-71330 — DoS via infinite loop (ICNS zero entry length)
npm audit fix will not switch package names automatically.
Maintained drop-in
Community MIT fork with the same public API as image-size@2.0.2:
- npm: https://www.npmjs.com/package/image-size-next (
image-size-next@2.1.0) - GitHub: https://github.com/lcf2212dev/image-size-next
- Announcement: https://github.com/lcf2212dev/image-size-next/blob/main/ANNOUNCE.md
Not affiliated with the original image-size maintainer — honest community fork only.
Migration options
A — Direct dependency
npm install image-size-next
- import { imageSize } from 'image-size'
+ import { imageSize } from 'image-size-next'
B — Force transitive resolution (npm 8.3+)
{
"overrides": {
"image-size": "npm:image-size-next@2.1.0"
}
}
Ask
Happy to open a PR for appdmg-tf if useful. Thanks for maintaining open source.
cc @LinusU
- Dominant language
- JavaScript
- Stars
- 1.7k
- Forks
- 158
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from LinusU/node-appdmg
-
Security: vulnerable dependency image-size (CVE-2025-71329/71330) — maintained drop-in available Open
Difficulty 2/5 1-3 hours Newbie friendliness 58/100
LinusU/node-appdmg#249 ·
-
Security: vulnerable dependency image-size (CVE-2025-71329/71330) — maintained drop-in available Open
Difficulty 2/5 1-3 hours Newbie friendliness 55/100
LinusU/node-appdmg#248 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
LinusU/node-appdmg#245 ·
-
Install failed Open
Difficulty 4/5 3-5 days Newbie friendliness 25/100
LinusU/node-appdmg#244 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
LinusU/node-appdmg#241 ·
All issues in LinusU/node-appdmg
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
HarperFast/skills#96 ·
-
[Block] Latest Posts [Type] Bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
sugarlabs/musicblocks#8847 ·