Security: vulnerable dependency image-size (CVE-2025-71329/71330) — maintained drop-in available

[lcf2212dev]

Context

This package depends on npm image-size. Upstream is archived and the latest release (2.0.2) remains affected by:

• CVE-2025-71329 — DoS via infinite loop (JXL/HEIF/JP2 zero-size boxes)
• CVE-2025-71330 — DoS via infinite loop (ICNS zero entry length)

npm audit fix will not switch package names automatically.

Maintained drop-in

Community MIT fork with the same public API as image-size@2.0.2:

• npm: https://www.npmjs.com/package/image-size-next (image-size-next@2.1.0)
• GitHub: https://github.com/lcf2212dev/image-size-next
• Announcement: https://github.com/lcf2212dev/image-size-next/blob/main/ANNOUNCE.md

Not affiliated with the original image-size maintainer — honest community fork only.

Migration options

A — Direct dependency

npm install image-size-next

- import { imageSize } from 'image-size'
+ import { imageSize } from 'image-size-next'

fromFile: image-size/fromFile → image-size-next/fromFile

B — Force transitive resolution (npm 8.3+)

{
  "overrides": {
    "image-size": "npm:image-size-next@2.1.0"
  }
}

Ask

Happy to open a PR if that helps. Flagging this so maintainers of @wellbye/metro can patch on their schedule.

Thanks for maintaining open source.

[Reinaldotec]

Can you please fix and update

…

On Mon, Aug 10, 2026, 10:08 AM Leandro Faria ***@***.***> wrote: Context This package depends on npm *image-size*. Upstream is *archived* and the latest release (*2.0.2*) remains affected by: - *CVE-2025-71329 <https://github.com/advisories/GHSA-5p2g-fcmc-qvqq>* — DoS via infinite loop (JXL/HEIF/JP2 zero-size boxes) - *CVE-2025-71330 <https://github.com/advisories/GHSA-w3rx-r6r6-pgpr>* — DoS via infinite loop (ICNS zero entry length) npm audit fix will *not* switch package names automatically. Maintained drop-in Community MIT fork with the same public API as ***@***.***: - *npm:* https://www.npmjs.com/package/image-size-next ( ***@***.***) - *GitHub:* https://github.com/lcf2212dev/image-size-next - *Announcement:* https://github.com/lcf2212dev/image-size-next/blob/main/ANNOUNCE.md Not affiliated with the original image-size maintainer — honest community fork only. Migration options *A — Direct dependency* npm install image-size-next - import { imageSize } from 'image-size'+ import { imageSize } from 'image-size-next' fromFile: image-size/fromFile → image-size-next/fromFile *B — Force transitive resolution (npm 8.3+)* { "overrides": { "image-size": ***@***.***" } } Ask Happy to open a PR if that helps. Flagging this so maintainers of ***@***.***/metro* can patch on their schedule. Thanks for maintaining open source. — Reply to this email directly, view it on GitHub <#1842?email_source=notifications&email_token=BSPQEYOC3FWT4CPAVXVW64D5JH6SBA5CNFSNUABBM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63RPGEYDKOBZGIZDNJTSMVQXG33OVJZXKYTTMNZGSYTFMSSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BSPQEYKOK5XXA5UOV4QSPSL5JH6SBAVCNFSNUABHKJSXA33TNF2G64TZHM3TMNJQGQZDINR3IRUXGY3VONZWS33OHMYTANJYHEZDENVBOYBA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[robhogan]

#1607