Description
The ensureSize() function in @dicebear/converter (versions < 9.4.0) read the width and height attributes from the input SVG to determine the output canvas size for rasterization (PNG, JPEG, WebP, AVIF). An attacker who can supply a crafted SVG with extremely large dimensions (e.g.
Recommendation
Update the @dicebear/converter package to the latest compatible version. Followings are version details:
- Affected version(s): < 9.4.0
- Patched version(s): 9.4.0
References
Could your website be exposed too?
SmartScanner can check your website for Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter and gives you actionable findings to investigate.
Start a free scanRelated Issues
- SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize() - CVE-2026-33418
- SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials - @dicebear/core - CVE-2026-33311
- SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials - CVE-2026-33311
- Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - CVE-2026-34043
You might also like:
See something that needs correcting? Let us knowUpdated March 19, 2026