CVE-2026-33418

The record

DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the `ensureSize()` function in `@dicebear/converter` used a regex-based approach to rewrite SVG `width`/`height` attributes, capping them at 2048px to prevent denial of service. This size capping could be bypassed by crafting SVG input that causes the regex to match a non-functional occurrence of `<svg` before the actual SVG root element. When the SVG is subsequently rendered via `@resvg/resvg-js` on the Node.js code path, it renders at the attacker-specified dimensions, potentially causing out-of-memory crashes. In version 9.4.2, the regex-based approach has been replaced with XML-aware processing using `fast-xml-parser` to correctly identify and modify the SVG root element's attributes. Additionally, a `fitTo` constraint has been added to the `renderAsync` call as defense-in-depth, ensuring the rendered output is always bounded regardless of SVG content.

Affected packages

Related vulnerabilities

• GHSA-7j2x-32w6-p43p SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize() Same vulnerability
• CVE-2026-29112 DiceBear is an avatar library for designers and developers. Also affects @dicebear/converter
• GHSA-v3r3-4qgc-vw66 Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter Also affects @dicebear/converter
• CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-185
• CVE-2026-88021 Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect… CWE-185
• CVE-2026-73425 Astro is a web framework for content-driven websites. CWE-185
• CVE-2026-64655 GitHub CLI (gh) is GitHub’s official command line tool. CWE-185
• CVE-2026-56021 Webmin allows unauthenticated attackers to read the contents of any file ending in .conf… CWE-185