Workarounds for CVE-2025-71329 / CVE-2025-71330 — 1.x (Metro) and 2.x

[lcf2212dev]

Upstream image-size is archived. Both published lines remain affected by CVE-2025-71329 and CVE-2025-71330 (event-loop DoS on crafted images). npm audit fix will not rename the package.

This repository is a community MIT fork (not affiliated with the original maintainer). Use the pin that matches the major you already have. Do not mix.

Your tree	Vulnerable upstream	Drop-in	npm dist-tag	Compare
Metro / React Native / image-size@^1	1.2.1	image-size-next@1.2.2	legacy	v1.2.1...v1.2.2
image-size@^2	2.0.2	image-size-next@2.1.1	latest	v2.0.2...v2.1.1

Overrides

{
  "overrides": {
    "image-size": "npm:image-size-next@1.2.2"
  }
}

{
  "overrides": {
    "image-size": "npm:image-size-next@2.1.1"
  }
}

Yarn: resolutions. pnpm: pnpm.overrides.

Metro 0.84.5 / 0.83.8 vendored image parsers and dropped image-size. Older Metro still on npm resolves ^1.0.2 → 1.2.1 and needs the legacy pin.

Happy to review PRs that swap the dependency or add an override. Please do not file security reports against the archived upstream repo.