Summary
@mastra/memory depends on image-size@2.0.2 (the current latest), which has an unpatched, high-severity Denial-of-Service vulnerability with no fixed version available. This causes Snyk/Dependabot to flag any project that installs @mastra/memory.
@mastra/memory@1.20.0 › image-size@2.0.2
Vulnerability
CVE-2025-71330 — image-size through 2.0.2 contains a DoS infinite-loop flaw in the ICNS handler: a crafted ICNS image with a zero-valued entry length prevents the parser offset from advancing, permanently blocking the Node.js event loop. It affects 2.0.2 and has no fixed release (2.0.2 is still latest).
Separately, Snyk also flags an infinite loop in extractPartialStreams() for HEIF/JP2/JXL in 2.0.2, described as a bypass of the (now-patched) CVE-2025-71319; this one does not yet have an assigned NVD CVE. Same root cause — a box declaring size 0 halts loop progress.
(For reference, CVE-2025-71319 — the HEIF/JP2/JXL findBox loop — was fixed in 2.0.2, so it does not affect this dependency. The problem is the remaining unpatched paths above.)
Suggested remediation
Until a patched 2.x is published, consider pinning image-size to the maintained legacy release 1.2.1 (the legacy dist-tag), which predates the vulnerable code paths. @mastra/memory uses the default import + imageSize(buffer) API, which is unchanged in 1.2.1, so this is API-compatible.
Downstream consumers can work around it today with an overrides entry:
{
"pnpm": {
"overrides": {
"image-size@>=2.0.0": "1.2.1"
}
}
}It would be ideal for @mastra/memory to either relax its image-size constraint to allow 1.2.1, or upgrade once a fixed 2.x ships.
Environment
@mastra/memory@1.20.0image-size@2.0.2
Summary
@mastra/memorydepends onimage-size@2.0.2(the currentlatest), which has an unpatched, high-severity Denial-of-Service vulnerability with no fixed version available. This causes Snyk/Dependabot to flag any project that installs@mastra/memory.Vulnerability
CVE-2025-71330 —
image-sizethrough2.0.2contains a DoS infinite-loop flaw in the ICNS handler: a crafted ICNS image with a zero-valued entry length prevents the parser offset from advancing, permanently blocking the Node.js event loop. It affects2.0.2and has no fixed release (2.0.2 is stilllatest).image-sizethrough2.0.2— unpatchedSeparately, Snyk also flags an infinite loop in
extractPartialStreams()for HEIF/JP2/JXL in2.0.2, described as a bypass of the (now-patched) CVE-2025-71319; this one does not yet have an assigned NVD CVE. Same root cause — a box declaring size0halts loop progress.(For reference, CVE-2025-71319 — the HEIF/JP2/JXL
findBoxloop — was fixed in2.0.2, so it does not affect this dependency. The problem is the remaining unpatched paths above.)Suggested remediation
Until a patched
2.xis published, consider pinningimage-sizeto the maintained legacy release1.2.1(thelegacydist-tag), which predates the vulnerable code paths.@mastra/memoryuses the default import +imageSize(buffer)API, which is unchanged in1.2.1, so this is API-compatible.Downstream consumers can work around it today with an
overridesentry:{ "pnpm": { "overrides": { "image-size@>=2.0.0": "1.2.1" } } }It would be ideal for
@mastra/memoryto either relax itsimage-sizeconstraint to allow1.2.1, or upgrade once a fixed2.xships.Environment
@mastra/memory@1.20.0image-size@2.0.2