Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter

Description

The ensureSize() function in @dicebear/converter (versions < 9.4.0) read the width and height attributes from the input SVG to determine the output canvas size for rasterization (PNG, JPEG, WebP, AVIF). An attacker who can supply a crafted SVG with extremely large dimensions (e.g.

Recommendation

Update the @dicebear/converter package to the latest compatible version. Followings are version details:

• Affected version(s): < 9.4.0
• Patched version(s): 9.4.0

References

• GHSA-v3r3-4qgc-vw66
• CVE-2026-29112
• CWE-770
• CAPEC-310
• OWASP 2021-A6

Related Issues

• SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize() - CVE-2026-33418
• SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials - @dicebear/core - CVE-2026-33311
• SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials - CVE-2026-33311
• Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - CVE-2026-34043

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@dicebear/converter