GHSA-xpqw-6gx7-v673
High · 7.5CVSS
7.5
EPSS
—
Published
Mar 4, 2026
CISA due date
—
The record
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | svgo | 2.1.0 | 2.8.1 |
| npm | svgo | 3.0.0 | 3.3.3 |
| Chainguard | librechat | 0 | 0.8.3-r0 |
| Chainguard | vitess-22 | 0 | 22.0.4-r6 |
| Chainguard | vitess-23 | 0 | 23.0.3-r7 |
| Wolfi | vitess-22 | 0 | 22.0.4-r6 |
| Wolfi | vitess-23 | 0 | 23.0.3-r7 |
Related vulnerabilities
- CVE-2026-29074 SVGO, short for SVG Optimizer, is a Node.js library and command-line application for… Same vulnerability
- CVE-2026-27138 Certificate verification can panic when a certificate in the chain has an empty DNS name… Also affects librechat
- CVE-2026-27137 When verifying a certificate chain which contains a certificate containing multiple email… Also affects librechat
- CVE-2026-29087 @hono/node-server allows running the Hono application on Node.js. Also affects librechat
- CVE-2026-29045 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat
- CVE-2026-29085 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat
- CVE-2026-29086 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat
- GHSA-wc8c-qw6v-h7f6 @hono/node-server has authorization bypass for protected static paths via encoded slashes… Also affects librechat