CVE-2026-29074 Details
Description
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.
A denial-of-service vulnerability has been identified in SVGO, a Node.js library for optimizing SVG files. This issue affects SVGO versions 2.1.0 prior to 2.8.1, 3.0.0 prior to 3.3.3, and all versions prior to 4.0.1. The vulnerability arises because SVGO accepts XML with custom entities without proper safeguards against entity expansion or recursion. As a result, a small XML file can cause the application to stall and crash the Node.js process due to running out of memory. This vulnerability is particularly concerning when SVGO is used on untrusted input, such as user-uploaded SVGs in a server-side application.
Users are advised to upgrade to SVGO versions 2.8.1, 3.3.3, or 4.0.1. For SVGO version 4.0.0, it is recommended to upgrade the 'sax' package, which is used for XML parsing, to the latest version. Users of SVGO versions 2.1.0 to 3.3.2 should manually check for custom entities in the DOCTYPE before passing SVG files to SVGO.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-776 | Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') | redhat-SADP |
| CWE-776 | Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| svgo svgo | >= 2.1.0, < 2.8.1 >= 3.0.0, < 3.3.3 >= 4.0.0, < 4.0.1 |
CPE
Remediation
| |
Change History
14 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | redhat-SADP |
| Sep 10, 2026 | CVE Modified | [email protected] |
| Aug 17, 2026 | CVE Modified | redhat-SADP |
| Aug 12, 2026 | CVE Modified | redhat-SADP |
| Jul 30, 2026 | CVE Modified | redhat-SADP |
| Jul 20, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 10, 2026 | CVE Modified | redhat-SADP |
| Jul 1, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Mar 10, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | New CVE Received | [email protected] |