Node.js CVE-2026-33418
HIGH
GHSA-7j2x-32w6-p43p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious SVG with fake `<svg` tag before root element
-
ExploitBypass regex-based width/height validation in ensureSize()
-
ExecutionPass oversized dimensions to @resvg/resvg-js renderer
-
ImpactTrigger out-of-memory denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Incorrect input validation
|
| Exploitation Conditions | Remote unauthenticated attacker sends crafted SVG input to applications using @dicebear/converter that process SVGs via @resvg/resvg-js on Node.js. SVG must contain a decoy '<svg' string before the actual root element to bypass regex-based width/height capping at 2048px, triggering out-of-memory DoS. |
| Impact | The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector indicates an easily exploitable network-accessible attack with no prerequisites, though impact is strictly availability. The attack complexity is low, making it trivial to craft bypass payloads once the vulnerability mechanism is understood. While no EPSS score or KEV inclusion is mentioned in the provided intelligence, the narrow scope (availability-only, single npm package, requires specific Node.js code path usage) and immediate patch availability via XML-aware parsing significantly reduce real-world urgency. This is a legitimate DoS risk for applications processing untrusted SVG input through @dicebear/converter's Node.js functions, but not a critical infrastructure threat. The SSVC framework would classify this as having technical impact of partial (availability only), likely not automatable at scale without reconnaissance, and requiring developer attention rather than emergency response. |
| Exploit ScenarioDerived | An attacker submits a malicious SVG to a web application that offers SVG-to-PNG conversion powered by @dicebear/converter on Node.js. The SVG contains a decoy <svg string embedded in an XML comment followed by the actual root element with width and height set to 50000 pixels each. The regex matches the comment-embedded decoy and leaves the real dimensions unclamped, causing renderAsync to allocate approximately 10GB of memory for a 50000x50000 RGBA bitmap, crashing the Node.js process and making the service unavailable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
A regex-based bypass vulnerability in the @dicebear/converter npm package allows attackers to circumvent SVG dimension sanitization by injecting decoy <svg tags in XML constructs. Applications using @dicebear/converter on Node.js to process untrusted SVG input are vulnerable to denial of service through unbounded memory allocation when rendering malformed SVGs. The CVSS score of 7.5 reflects the high availability impact with network-accessible attack vector requiring no authentication or user interaction.
RemediationAI
Upgrade to the patched version of @dicebear/converter that replaces regex-based SVG parsing with fast-xml-parser for context-aware XML processing and adds fitTo constraints to renderAsync calls, as documented in the GitHub advisory at https://github.com/dicebear/dicebear/security/advisories/GHSA-7j2x-32w6-p43p. Until patching is complete, implement defense-in-depth by validating and sanitizing all SVG input through a dedicated XML parser before passing to conversion functions, enforcing strict size limits at the application layer, and running conversion processes in resource-constrained containers or worker processes with memory limits to prevent full system exhaustion. For environments where @dicebear/converter is used exclusively for internally-generated content rather than user-supplied SVGs, the risk is minimal and patching can follow normal update cycles.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects pkg:npm/@dicebear_converter, a Node.js library for converting SVG to raster formats using @resvg/resvg-js. The root cause is CWE-185 (Incorrect Regular Expression), where the ensureSize() function used a non-global regex with String.prototype.replace() to find and cap dimensions at the first <svg occurrence. Because regex cannot parse XML context-aware structures, attackers could inject a non-functional <svg string inside XML comments, CDATA sections, or other constructs, causing the regex to match the decoy instead of the actual SVG root element. The Node.js rendering path then invoked renderAsync without fitTo constraints, respecting the unclamped attacker-controlled dimensions and potentially allocating gigabytes of memory. The browser code path remained secure because it explicitly set canvas dimensions from the clamped size value.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Summary
The ensureSize() function in @dicebear/converter used a regex-based approach to rewrite SVG width/height attributes, capping them at 2048px to prevent denial of service. This size capping could be bypassed by crafting SVG input that causes the regex to match a non-functional occurrence of <svg before the actual SVG root element. When the SVG is subsequently rendered via @resvg/resvg-js on the Node.js code path, it renders at the attacker-specified dimensions, potentially causing out-of-memory crashes.
Details
The vulnerable function used String.prototype.replace() with a non-global regex to find and rewrite the first <svg tag's dimensions. Since the regex does not distinguish between <svg appearing inside non-element XML constructs and the actual SVG root element, a crafted input can cause the regex to match a decoy instead of the real element, leaving the actual SVG dimensions unclamped.
In the Node.js rendering path, renderAsync from @resvg/resvg-js was called without a fitTo constraint, so it would render at whatever dimensions the SVG element specified - potentially allocating gigabytes of memory.
The browser code path is not vulnerable because it uses the clamped size return value from ensureSize() to set canvas.width and canvas.height directly.
Impact
Any application that passes untrusted or user-supplied SVG content through @dicebear/converter's Node.js conversion functions (toPng, toJpeg, toWebp, toAvif) is vulnerable to denial of service via excessive memory allocation. Note that @dicebear/converter can be used independently of DiceBear's avatar generation - any SVG string can be passed to the conversion functions.
The impact is limited to availability - there is no data disclosure or integrity impact. The browser code path is not affected.
Fix
The regex-based approach has been replaced with XML-aware processing using fast-xml-parser to correctly identify and modify the SVG root element's attributes. Additionally, a fitTo constraint has been added to the renderAsync call as defense-in-depth, ensuring the rendered output is always bounded regardless of SVG content.
Blast Radius
ecosystem impact- 1 npm packages depend on @dicebear/converter (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 9.4.2.
Executive ViewAI
A high-severity vulnerability in the @dicebear/converter npm package enables attackers to cause denial of service attacks against applications processing untrusted SVG files, potentially disrupting services that rely on avatar or image generation. Any organization using this package in production environments faces immediate risk of service availability impact without a vendor patch currently available.
Implement strict input validation with file size limits (max 1MB SVG); deploy rate limiting and request throttling on SVG processing endpoints; configure WAF rules to detect and block malformed <svg tag injections and regex bypass patterns; isolate SVG processing services in separate containers with memory limits and CPU caps; use network segmentation to restrict access to SVG processing APIs; disable SVG rendering features entirely if not business-critical; implement aggressive monitoring for memory usage spikes and process CPU anomalies; consider temporary blocklisting of @dicebear/converter package until patch availability
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)GitHub Advisory
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB