[GH-ISSUE #370] Security: vulnerable dependency image-size (CVE-2025-71329/71330) — maintained drop-in available #367

New issue

Open

opened 2026-10-02 23:16:57 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-10-02 23:16:57 -06:00

Owner

Originally created by @lcf2212dev on GitHub (Aug 10, 2026).
Original GitHub issue: https://github.com/kusti8/proton-native/issues/370

Context

This package depends on npm image-size. Upstream is archived and the latest release (2.0.2) remains affected by:

CVE-2025-71329 — DoS via infinite loop (JXL/HEIF/JP2 zero-size boxes)
CVE-2025-71330 — DoS via infinite loop (ICNS zero entry length)

npm audit fix will not switch package names automatically.

Maintained drop-in

Community MIT fork with the same public API as image-size@2.0.2:

npm: https://www.npmjs.com/package/image-size-next (image-size-next@2.1.0)
GitHub: https://github.com/lcf2212dev/image-size-next
Announcement: https://github.com/lcf2212dev/image-size-next/blob/main/ANNOUNCE.md

Not affiliated with the original image-size maintainer — honest community fork only.

Migration options

A — Direct dependency

npm install image-size-next

- import { imageSize } from 'image-size'
+ import { imageSize } from 'image-size-next'

B — Force transitive resolution (npm 8.3+)

{
  "overrides": {
    "image-size": "npm:image-size-next@2.1.0"
  }
}

Ask

Happy to open a PR for proton-native if useful. Thanks for maintaining open source.

cc @kusti8

Originally created by @lcf2212dev on GitHub (Aug 10, 2026). Original GitHub issue: https://github.com/kusti8/proton-native/issues/370 ## Context This package depends on npm **`image-size`**. Upstream is **archived** and the latest release (**2.0.2**) remains affected by: - **CVE-2025-71329** — DoS via infinite loop (JXL/HEIF/JP2 zero-size boxes) - **CVE-2025-71330** — DoS via infinite loop (ICNS zero entry length) `npm audit fix` will **not** switch package names automatically. ## Maintained drop-in Community MIT fork with the same public API as `image-size@2.0.2`: - **npm:** https://www.npmjs.com/package/image-size-next (`image-size-next@2.1.0`) - **GitHub:** https://github.com/lcf2212dev/image-size-next - **Announcement:** https://github.com/lcf2212dev/image-size-next/blob/main/ANNOUNCE.md Not affiliated with the original `image-size` maintainer — honest community fork only. ## Migration options **A — Direct dependency** ```bash npm install image-size-next ``` ```diff - import { imageSize } from 'image-size' + import { imageSize } from 'image-size-next' ``` **B — Force transitive resolution (npm 8.3+)** ```json { "overrides": { "image-size": "npm:image-size-next@2.1.0" } } ``` ## Ask Happy to open a PR for **`proton-native`** if useful. Thanks for maintaining open source. cc @kusti8