Security: vulnerable dependency image-size (CVE-2025-71329/71330) — maintained drop-in available
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 58/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- javascript, node.js
- Domain
- security
Research direction
Start at the package dependency declaration and the import path shown in the issue, then compare the direct-dependency and npm override options. Done means the vulnerable image-size dependency is replaced or overridden with image-size-next@2.1.0 and the package continues to use the documented public API.
Written by the indexing model from the issue text.
Description
Context
This package depends on npm image-size. Upstream is archived and the latest release (2.0.2) remains affected by:
- CVE-2025-71329 — DoS via infinite loop (JXL/HEIF/JP2 zero-size boxes)
- CVE-2025-71330 — DoS via infinite loop (ICNS zero entry length)
npm audit fix will not switch package names automatically.
Maintained drop-in
Community MIT fork with the same public API as image-size@2.0.2:
- npm: https://www.npmjs.com/package/image-size-next (
image-size-next@2.1.0) - GitHub: https://github.com/lcf2212dev/image-size-next
- Announcement: https://github.com/lcf2212dev/image-size-next/blob/main/ANNOUNCE.md
Not affiliated with the original image-size maintainer — honest community fork only.
Migration options
A — Direct dependency
npm install image-size-next
- import { imageSize } from 'image-size'
+ import { imageSize } from 'image-size-next'
B — Force transitive resolution (npm 8.3+)
{
"overrides": {
"image-size": "npm:image-size-next@2.1.0"
}
}
Ask
Happy to open a PR for @alexpelan/appdmg if useful. Thanks for maintaining open source.
cc @LinusU
- Dominant language
- JavaScript
- Stars
- 1.7k
- Forks
- 158
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from LinusU/node-appdmg
-
Security: vulnerable dependency image-size (CVE-2025-71329/71330) — maintained drop-in available Open
Difficulty 2/5 1-3 hours Newbie friendliness 55/100
LinusU/node-appdmg#248 ·
-
Security: vulnerable dependency image-size (CVE-2025-71329/71330) — maintained drop-in available Open
Difficulty 2/5 1-3 hours Newbie friendliness 52/100
LinusU/node-appdmg#247 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
LinusU/node-appdmg#245 ·
-
Install failed Open
Difficulty 4/5 3-5 days Newbie friendliness 25/100
LinusU/node-appdmg#244 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
LinusU/node-appdmg#241 ·
All issues in LinusU/node-appdmg
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
HarperFast/skills#96 ·
-
[Block] Latest Posts [Type] Bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
sugarlabs/musicblocks#8847 ·