image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.

Affected: npm: image-size

### Summary

`image-size` is vulnerable to a Denial of Service vulnerability when processing specially crafted images.

The issue occurs because of an infine loop in `findBox` when processing certain images with a box with size `0`.

### Details

If the first bytes of the input does not match any bytes in `firstBytes`, then the package tries to validate the image using other handlers: ```js // https://github.com/image-size/image-size/blob/v1.2.0/lib/detector.ts#L20-L31 export function detector(input: Uint8Array): imageType | undefined { const byte = input[0] if (byte in firstBytes) { const type = firstBytes[byte] if (type && typeHandlers[type].validate(input)) { return type } }

const finder = (key: imageType) => typeHandlers[key].validate(input) //<-- return keys.find(finder) } ```

Some handlers that call `findBox` to validate or calculate the image size are `jxl`, `heif` and `jp2`.

`JXL` handler calls `findBox` inside `validate`. To reach the `findBox` call, the value at position `4:8` should be `'JXL '` ```js // https://github.com/image-size/image-size/blob/v1.2.0/lib/types/jxl.ts#L51-L60 export const JXL: IImage = { validate: (input: Uint8Array): boolean => { const boxType = toUTF8String(input, 4, 8) if (boxType !== 'JXL ') return false //<---

const ftypBox = findBox(input, 'ftyp', 0) //<--- if (!ftypBox) return false

const brand = toUTF8String(input, ftypBox.offset + 8, ftypBox.offset + 12) return brand ===…

libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification libxslt: use-after-free with key data stored cross-RVT libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string image-size: image-size: Denial of Service due to infinite loop when processing specially crafted images. python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite nginx: ngx_http_rewrite_module: code execution and denial of service openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key libpng: libpng: Arbitrary code execution due to use-after-free vulnerability libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion vim: Command injection allows arbitrary code execution via malicious tag files urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers urllib3: urllib3: Denial of Service due to excessive HTTP response decompression