Security: vulnerable dependency image-size (CVE-2025-71329/71330) — maintained drop-in available
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 62/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- javascript, react-native
- Domain
- mobile-dev, security
Research direction
Start by inspecting package.json and searching for the imageSize import shown in the issue. Confirm whether the maintained image-size-next package preserves the current API and check the existing project validation commands. Done means the vulnerable image-size dependency is replaced or overridden without breaking the image editor's existing behavior.
Written by the indexing model from the issue text.
Description
Context
This package depends on npm image-size. Upstream is archived and the latest release (2.0.2) remains affected by:
- CVE-2025-71329 — DoS via infinite loop (JXL/HEIF/JP2 zero-size boxes)
- CVE-2025-71330 — DoS via infinite loop (ICNS zero entry length)
npm audit fix will not switch package names automatically.
Maintained drop-in
Community MIT fork with the same public API as image-size@2.0.2:
- npm: https://www.npmjs.com/package/image-size-next (
image-size-next@2.1.0) - GitHub: https://github.com/lcf2212dev/image-size-next
- Announcement: https://github.com/lcf2212dev/image-size-next/blob/main/ANNOUNCE.md
Not affiliated with the original image-size maintainer — honest community fork only.
Migration options
A — Direct dependency
npm install image-size-next
- import { imageSize } from 'image-size'
+ import { imageSize } from 'image-size-next'
B — Force transitive resolution (npm 8.3+)
{
"overrides": {
"image-size": "npm:image-size-next@2.1.0"
}
}
Ask
Happy to open a PR for birken-react-native-community-image-editor if useful. Thanks for maintaining open source.
- Dominant language
- Kotlin
- Stars
- 447
- Forks
- 118
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 4
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from callstack/react-native-image-editor
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
callstack/react-native-image-editor#163 · 4 comments ·
All issues in callstack/react-native-image-editor
Similar issues
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
index-request triaged
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Anthonyy232/Paperize#614 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
bitcoindevkit/bdk-ffi#1125 ·
-
🌑 nextgen
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
CCBlueX/LiquidBounce#9214 · 1 comment ·