Is image-size safe to use?

image-size has 2 known vulnerabilities on the latest version (2.0.2). DepScope rates its health at 57/100 (high risk).

What is the latest version of image-size?

The latest version of image-size is 2.0.2, released 2025-04-02.

Does image-size have known vulnerabilities?

Yes. image-size has 2 known vulnerabilities. See depscope.dev/pkg/npm/image-size for details.

Is image-size deprecated?

No, image-size is actively maintained. Latest release: 2.0.2 (2025-04-02).

What are alternatives to image-size?

Popular alternatives to image-size in npm include: ?, semver, minimatch, debug, ansi-styles.

What license does image-size use?

image-size is licensed under MIT.

image-size

npmv2.0.2

get dimensions of any image file

License MITpermissive71 versions1 maintainers0 deps35,062,537 weekly dl

image-size/image-size

/ 100

Health

update required

[email protected] has vulnerabilities — update to latest

Moderate health score (57/100) — verify manually
2 high severity vulnerabilities

Health breakdown0 – 100

0/25

maintenance

20/20

popularity

15/25

security

15/15

maturity

7/15

community

0/15

popularity_floor

Vulnerabilities

2 high

Advisories (2)

Severity	ID	Summary	Fixed in
high	CVE-2025-71329	image-size: JXL and HEIF parsers allow denial of service through infinite loops	—
high	CVE-2025-71330	image-size: ICNS parser allows denial of service through an infinite loop	—

Bundle & TypeScript

🌟

TypeScript

10/10typed

bundled

Quality signals

Download trend

stable(+3.5%)

Publish security

npm signed

Health History

Dependency Tree

License Audit

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/image-size