GHSA-v3r3-4qgc-vw66
High · 7.5CVSS
7.5
EPSS
—
Published
Mar 16, 2026
CISA due date
—
The record
Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @dicebear/converter | 0 | 9.4.0 |
Related vulnerabilities
- CVE-2026-29112 DiceBear is an avatar library for designers and developers. Same vulnerability
- CVE-2026-33418 DiceBear is an avatar library for designers and developers. Also affects @dicebear/converter
- GHSA-7j2x-32w6-p43p SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize() Also affects @dicebear/converter
- CVE-2026-114731 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled… CWE-770
- CVE-2026-96377 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined… CWE-770
- CVE-2026-96365 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform… CWE-770
- CVE-2026-114723 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource… CWE-770
- CVE-2026-113811 Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory… CWE-770