CVE-2026-29074 SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)
Attackers can cause denial of service in SVGO by submitting malicious SVG files with entity expansion, leading to application crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-29074?
CVE-2026-29074 is a high-severity denial of service vulnerability in svgo, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.
Weakness: CWE-776
Which versions are affected by CVE-2026-29074?
6 open source packages ship an affected version, including svgo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
svgo npm | From 2.1.0 | 2.8.1 |
svgo npm | From 2.1.0 | 2.8.1 |
svgo npm | From 3.0.0 | 3.3.3 |
svgo npm | From 3.0.0 | 3.3.3 |
svgo npm | From 4.0.0 | 4.0.1 |
svgo npm | From 4.0.0 | 4.0.1 |
Products include Svgo Svgo.
How do I fix CVE-2026-29074?
Upgrade svgo to a fixed version for your release line: 2.8.1, 3.3.3 or 4.0.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-29074 being exploited?
There is no known exploitation of CVE-2026-29074 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1779324470, DEBIAN-CVE-2026-29074, GHSA-xpqw-6gx7-v673, ROOT-APP-NPM-CVE-2026-29074.