Summary
Stable Vinext releases currently retain a direct dependency on image-size@2.0.2, which is affected by two high-severity infinite-loop denial-of-service advisories:
GitHub currently lists no patched version, and the latest version published to npm is still 2.0.2. I checked the Vinext package manifests from 0.0.50 through the latest stable release, 0.2.1; each declares "image-size": "2.0.2".
Why consumers cannot simply omit it
Vinext statically imports imageSize from image-size in dist/server/metadata-route-build-data.js, and that module is loaded during server startup.
As a negative test, removing only the transitive image-size package from an otherwise working production installation causes vinext start to exit immediately:
Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'image-size' imported from /app/node_modules/vinext/dist/server/metadata-route-build-data.js
This occurs even when the application does not import next/image and contains none of the affected JXL, HEIF, or ICNS metadata image formats.
The 1.0.0 beta line appears not to include this dependency, but there is currently no non-prerelease upgrade path for stable consumers.
Request
Could a stable Vinext release or backport remove/replace image-size, make the metadata dimension parsing dependency optional/build-only, or otherwise avoid retaining the vulnerable package in the production runtime dependency graph?
This would provide a supported path for consumers whose production security gates require zero high-severity audit findings.
Verification environment
- Reproduced startup dependency behavior with Vinext 0.0.50
- Checked published dependency manifests through Vinext 0.2.1
- Node.js 24.20.0
- Audit command:
npm audit --omit=dev
Summary
Stable Vinext releases currently retain a direct dependency on
image-size@2.0.2, which is affected by two high-severity infinite-loop denial-of-service advisories:GitHub currently lists no patched version, and the latest version published to npm is still 2.0.2. I checked the Vinext package manifests from 0.0.50 through the latest stable release, 0.2.1; each declares
"image-size": "2.0.2".Why consumers cannot simply omit it
Vinext statically imports
imageSizefromimage-sizeindist/server/metadata-route-build-data.js, and that module is loaded during server startup.As a negative test, removing only the transitive
image-sizepackage from an otherwise working production installation causesvinext startto exit immediately:This occurs even when the application does not import
next/imageand contains none of the affected JXL, HEIF, or ICNS metadata image formats.The 1.0.0 beta line appears not to include this dependency, but there is currently no non-prerelease upgrade path for stable consumers.
Request
Could a stable Vinext release or backport remove/replace
image-size, make the metadata dimension parsing dependency optional/build-only, or otherwise avoid retaining the vulnerable package in the production runtime dependency graph?This would provide a supported path for consumers whose production security gates require zero high-severity audit findings.
Verification environment
npm audit --omit=dev