[GHSA-w3rx-r6r6-pgpr] image-size: ICNS parser allows denial of service through an infinite loop

[wojtekmaj]

Updates

• Affected products
• CVSS v3
• CVSS v4
• Description

Comments
Please change the affected range from <= 2.0.2 to >= 0.6.3, <= 2.0.2. The missing lower bound incorrectly includes releases published before ICNS support existed. This correction does not exclude 1.0.2, which remains affected, and does not claim that a patched release exists.

I inspected published npm tarballs across the stable release history. The ICNS parser first appears as package/lib/types/icns.js in 0.6.3. The 0.6.2 tarball has no ICNS handler, and its package/lib/types.js does not register ICNS. In 0.6.3, calculate() already advances imageOffset using the unvalidated imageHeader[1], including inside the while loop. A zero-length entry therefore leaves the offset unchanged.

I reproduced the problem directly against the published 0.6.3 parser, using Buffer.from('69636e73000000106973333200000000', 'hex'): detect() returns true, then calculate() does not terminate normally and exhausts a deliberately bounded child-process heap. The same issue reproduces against 1.0.2 and subsequent sampled releases through 2.0.2.

Published source artifacts:
https://registry.npmjs.org/image-size/-/image-size-0.6.2.tgz
https://registry.npmjs.org/image-size/-/image-size-0.6.3.tgz
https://registry.npmjs.org/image-size/-/image-size-1.0.2.tgz
https://registry.npmjs.org/image-size/-/image-size-2.0.2.tgz
https://muort.390202.xyz/image-size/image-size/releases/tag/v0.6.3

Form limitation: the improvement form rejects the existing CVSS v4 vector with optional metrics set to X. I removed only those Not Defined suffixes to submit the form; no severity change is intended. The form also appears to discard an existing CVSS v3 entry when submitting in CVSS v4 mode. Please preserve the original severity entries during curation; this request is solely a version-boundary correction and matching description clarification.

[Copilot]

🟡 Changes recommended

The existing CVSS v3 severity entry must be restored as requested in the PR description.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Narrows the affected image-size range to versions containing the vulnerable ICNS parser.

Changes:

• Sets the lower bound to 0.6.3.
• Clarifies why earlier releases are unaffected.
• Normalizes CVSS v4, but unintentionally removes CVSS v3.

File summaries

File	Description
GHSA-w3rx-r6r6-pgpr.json	Updates affected range, description, and severity data.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wojtekmaj]

Agreed. GitHub’s improvement form removed CVSS v3, and I can’t amend its generated branch. Please preserve the original severity data when reviewing.