SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)

The core of this vulnerability lies in SVGO's handling of XML files with custom entities. The library, relying on the sax XML parser, allows for entity expansion and recursion without sufficient safeguards. A malicious actor can construct a small XML file (approximately 811 bytes) that, when processed by SVGO, triggers uncontrolled entity expansion. This expansion rapidly consumes memory, ultimately leading to a JavaScript heap out of memory error and crashing the Node.js application. The blast radius extends to any application utilizing SVGO to process SVG images, potentially disrupting services and causing downtime. The ease of crafting a malicious XML file makes this vulnerability particularly concerning.

Applications and services that utilize SVGO for SVG image optimization are at risk. This includes web applications, build pipelines, and any automated processes that process SVG files. Specifically, projects relying on older versions of SVGO (prior to 2.8.1) and those lacking robust input validation are particularly vulnerable.

• nodejs / supply-chain: Monitor Node.js processes for excessive memory consumption and JavaScript heap out of memory errors.

ps aux | grep node | awk '{print $6, $7}' | sort -n

• nodejs / supply-chain: Check for SVGO versions prior to 2.8.1 installed in your project dependencies.

npm ls svgo

• generic web: Examine web server access logs for requests containing XML files with unusual or deeply nested custom entities. Look for patterns indicative of entity expansion attempts.

1. 2026-03-04Disclosure

   disclosure

1. आरक्षित2026-03-03
2. प्रकाशित2026-03-04
3. संशोधित2026-03-10
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-29074 is to upgrade SVGO to version 2.8.1 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing input validation to prevent the processing of XML files with potentially malicious custom entities. Specifically, validate the XML structure and restrict the use of custom entities. Additionally, consider implementing resource limits within your Node.js application to prevent a single process from consuming excessive memory. After upgrading, confirm the fix by attempting to process a known malicious XML file (if available) and verifying that the application does not crash or exhibit excessive memory consumption.

अंतिम अपडेट

4.0.12 महीने पहले