Executive brief
DiceBear converter is a library that converts avatars to image formats (PNG, JPEG, WebP, AVIF). A vulnerability in versions before 9.4.0 allows attackers to supply SVG files with extremely large width and height values, causing the server to allocate excessive memory and become unavailable. This impacts applications that process untrusted or user-supplied SVG input.
Technical details
The ensureSize() function in @dicebear/converter versions < 9.4.0 directly reads the width and height attributes from input SVG documents to determine output canvas size without validation or limits. An attacker can craft an SVG with extremely large dimension values (e.g. width="999999999") to trigger uncontrolled memory allocation, resulting in denial of service. This vulnerability affects the toPng(), toJpeg(), toWebp(), and toAvif() functions when processing untrusted SVG input. The vulnerability was patched in version 9.4.0, which replaces dynamic SVG attribute reading with a configurable size option (default 512, max 2048) with proper validation and fallback handling for invalid values.
Affected products
- DiceBear @dicebear/converter < 9.4.0
Timeline
- 2026-03-16: disclosed: GHSA advisory published
- 2026-03-16: patched: Fixed in version 9.4.0