GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq (image-size): patched version 2.0.3 has never been published

首先定位 GHSA-w3rx-r6r6-pgpr 和 GHSA-5p2g-fcmc-qvqq 的 advisory 记录，然后在 npm registry 中验证 image-size 的版本。在更改 patched-version 信息之前，先查看 repository 的 advisory metadata workflow。完成的标准是这些记录准确反映一个可安装的修复，或明确记录不存在可用修复。

Advisories

• GHSA-w3rx-r6r6-pgpr — image-size: ICNS parser allows denial of service through an infinite loop
• GHSA-5p2g-fcmc-qvqq — image-size: JXL and HEIF parsers allow denial of service through infinite loop

The problem

Both advisories record:

• vulnerable versions: <= 2.0.2
• patched versions: >= 2.0.3

image-size@2.0.3 does not exist on npm. The registry currently returns:

$ npm view image-size dist-tags
{ latest: '2.0.2', legacy: '1.2.1' }

The full published 2.x line ends at 2.0.2, which is inside the vulnerable range. So every published version of the package is vulnerable and the advertised remedy cannot be installed.

Why it matters downstream

The metadata is what automated remediation acts on. Attempting the advised upgrade fails outright:

$ pnpm audit
2 high severity vulnerabilities found

$ # pin to the advised patched range
[ERR_PNPM_NO_MATCHING_VERSION] No matching version found for image-size@>=2.0.3

image-size is reached transitively by a very large number of projects (in ours it arrives through react-native → metro), so any CI gate that fails on high-severity findings hits this. With no installable fix, the remaining options are suppressing the advisory or patching locally — and a suppression taken because the stated remedy silently failed is worse than one taken deliberately.

Suggested correction

If no fixed release exists yet, the advisories would be more accurate with no patched version recorded (or the range left open) rather than one pointing at an unpublished version. If a fix is released later, 2.0.3 can be filled in then and downstream tooling will act on it correctly.

Upstream issues are disabled on image-size/image-size, so I could not raise it there; filing here since the correction is to the advisory metadata.

Checked

Against the npm registry on 2026-08-08.