Came across something in pnpm-lock.yaml around line 1 that looked worth flagging.
The image-size library before version 2.0.3 contains a denial-of-service vulnerability in its JXL/HEIF parsers. An attacker can supply an image buffer with a box containing a zero-sized field, causing the parser to enter an infinite loop as it never advances the read offset. This can permanently block the Node.js event loop, making the application unresponsive. The risk is high because a single malicious image can crash the process, leading to service disruption.
Something like this might fix it:
Upgrade image-size to a fixed version (e.g., >=2.0.3) by updating the dependency version in package.json and running `pnpm install`.
For reference: rule CVE-2025-71329. Rated high.
I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Came across something in
pnpm-lock.yamlaround line 1 that looked worth flagging.The image-size library before version 2.0.3 contains a denial-of-service vulnerability in its JXL/HEIF parsers. An attacker can supply an image buffer with a box containing a zero-sized field, causing the parser to enter an infinite loop as it never advances the read offset. This can permanently block the Node.js event loop, making the application unresponsive. The risk is high because a single malicious image can crash the process, leading to service disruption.
Something like this might fix it:
For reference: rule
CVE-2025-71329. Rated high.I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.