Preston Price

**Name of the Vulnerable Software and Affected Versions** image-size versions prior to 2.0.3 **Description** A denial of service issue exists where remote attackers can permanently block the Node.js event loop by providing a specially crafted ICNS image buffer. By supplying an ICNS buffer with valid magic bytes and a zero-valued entry length field, an infinite loop is triggered in the ICNS parser because the offset is not incremented when the entry length is 0, causing the while loop condition to remain true indefinitely. **Recommendations** Update to version 2.0.3 or later.