QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-29074

Back to search

CVE-2026-29074

Published: Mar 6, 2026

Modified: Mar 6, 2026

PUBLISHED

CVSS v3.1

7.5

HIGH

Description

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.

VendorProductVersions

svg

svgo

affected
>= 2.1.0, < 2.8.1
affected
>= 3.0.0, < 3.3.3
affected
= 4.0.0

Weaknesses (CWE)

CWE-776

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now