GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq (image-size): patched version 2.0.3 has never been published

[PeteFofficial]

Advisories

• GHSA-w3rx-r6r6-pgpr — image-size: ICNS parser allows denial of service through an infinite loop
• GHSA-5p2g-fcmc-qvqq — image-size: JXL and HEIF parsers allow denial of service through infinite loop

The problem

Both advisories record:

• vulnerable versions: <= 2.0.2
• patched versions: >= 2.0.3

image-size@2.0.3 does not exist on npm. The registry currently returns:

$ npm view image-size dist-tags
{ latest: '2.0.2', legacy: '1.2.1' }

The full published 2.x line ends at 2.0.2, which is inside the vulnerable range. So every published version of the package is vulnerable and the advertised remedy cannot be installed.

Why it matters downstream

The metadata is what automated remediation acts on. Attempting the advised upgrade fails outright:

$ pnpm audit
2 high severity vulnerabilities found

$ # pin to the advised patched range
[ERR_PNPM_NO_MATCHING_VERSION] No matching version found for image-size@>=2.0.3

image-size is reached transitively by a very large number of projects (in ours it arrives through react-native → metro), so any CI gate that fails on high-severity findings hits this. With no installable fix, the remaining options are suppressing the advisory or patching locally — and a suppression taken because the stated remedy silently failed is worse than one taken deliberately.

Suggested correction

If no fixed release exists yet, the advisories would be more accurate with no patched version recorded (or the range left open) rather than one pointing at an unpublished version. If a fix is released later, 2.0.3 can be filled in then and downstream tooling will act on it correctly.

Upstream issues are disabled on image-size/image-size, so I could not raise it there; filing here since the correction is to the advisory metadata.

Checked

Against the npm registry on 2026-08-08.