CVE-2026-121444
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Nov 3, 2026
CISA due date
—
The record
svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration that pins PHP workers for hours.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-116668 Tanium addressed an uncontrolled resource consumption vulnerability in Discover. CWE-400
- CVE-2026-111751 Angular is a development platform for building mobile and desktop web applications using… CWE-400
- CVE-2026-111752 Angular is a development platform for building mobile and desktop web applications using… CWE-400
- CVE-2026-63476 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-400
- CVE-2026-121438 Mistune before 3.3.3 contains a denial of service vulnerability in… CWE-400
- CVE-2026-121404 FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server… CWE-400
- CVE-2026-49924 In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via… CWE-400
- CVE-2026-117531 @fastify/multipart is the multipart form-data and file upload plugin for the Fastify web… CWE-400