Junglewise Threat Intelligence

CVE-2026-29074: SVGO denial of service via XML entity expansion

CVE-2026-29074 · Severity: high · CVSS 7.5 · Published 2026-03-06

Technologies: Svgo.

Executive brief

SVGO is a popular tool used to optimize SVG images, often integrated into web applications to handle user-uploaded graphics. A vulnerability in how it processes certain files allows an attacker to upload a specially crafted, very small image that causes the application to consume massive amounts of memory. This can lead to the application freezing or crashing, resulting in a denial-of-service for legitimate users.

Technical details

SVGO (SVG Optimizer) is vulnerable to an XML Entity Expansion (CWE-776) attack, commonly known as a 'Billion Laughs' attack. The vulnerability exists because SVGO's internal logic enabled custom XML entity parsing in the 'sax' parser without implementing guards against recursive or exponential expansion. An attacker can provide a crafted SVG file (under 1 KB) containing nested entities that, when expanded during optimization, exhaust the Node.js heap memory and crash the process. This is particularly impactful for server-side applications processing untrusted user uploads. The issue is fixed in versions 2.8.1, 3.3.3, and 4.0.1 by utilizing safer parsing options in the upstream dependency.

Affected products

  • svg svgo >= 2.1.0, < 2.8.1; >= 3.0.0, < 3.3.3; < 4.0.1

Timeline

  • 2026-03-04: advisory: GitHub Security Advisory published by maintainers
  • 2026-03-06: disclosed: NVD publication date
  • 2026-03-04: patched: Patched versions released

References