High-severity Dependabot alerts from image-size (archived, no fix available) via @netlify/dev-utils

[intrepidws]

Summary

Installing netlify-cli currently pulls in image-size@2.0.2 (via @netlify/dev-utils), which has two open high-severity advisories with no patched version available:

• CVE-2025-71330 / GHSA-w3rx-r6r6-pgpr — ICNS parser allows denial of service through an infinite loop (affects <= 2.0.2)
• CVE-2025-71329 / GHSA-5p2g-fcmc-qvqq — JXL and HEIF parsers allow denial of service through infinite loops (affects <= 2.0.2)

This causes Dependabot alerts in any repo that depends on netlify-cli, and since there is no fixed release to bump to, Dependabot cannot auto-remediate them.

Dependency chain

netlify-cli@27.1.1
└─┬ @netlify/dev-utils@4.4.7
  └── image-size@2.0.2   (declared as ^2.0.2)

(Verified against the latest published versions as of 2026-08-12.)

Why this likely won't resolve on its own

The image-size repository has been archived (last push June 2026), so a patched release addressing these CVEs does not appear to be coming. Waiting for an upstream fix probably isn't a viable path — the dependency likely needs to be replaced, vendored, or the affected parsers avoided in @netlify/dev-utils.

Impact

• Both advisories are rated high severity (DoS via infinite loop on crafted images).
• Downstream projects get persistent, unfixable Dependabot alerts for as long as netlify-cli depends on image-size.

Steps to reproduce

1. npm install netlify-cli in a project with Dependabot alerts enabled
2. Dependabot flags image-size in package-lock.json with the two advisories above

Happy to provide more detail if useful. Filing here since netlify-cli is the entry point, though the direct dependency lives in @netlify/dev-utils — feel free to transfer if there's a better home for it.