CVE-2026-29074: SVGO DoS Vulnerability via Entity Expansion in DOCTYPE
Summary
CVE-2026-29074: SVGO DoS through entity expansion in DOCTYPE (Billion Laughs). Affects svgo across 3 version ranges.
>= 2.1.0, < 2.8.1
>= 3.0.0, < 3.3.3
>= 4.0.0, < 4.0.1
Fixed in 2.8.1, 3.3.3 or 4.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
SVGO is a popular Node.js-based tool used for optimizing SVG files. It reduces file size and improves performance by removing unnecessary data and optimizing the structure of SVG images. However, SVGO has a vulnerability that allows for denial-of-service (DoS) attacks through entity expansion in DOCTYPE declarations, making it susceptible to malicious SVG files.
Vulnerability Detail
The vulnerability arises from SVGO's acceptance of XML with custom entities without proper safeguards against entity expansion or recursion. This flaw can lead to a small XML file causing the application to stall or crash due to excessive memory consumption, resulting in a 'JavaScript heap out of memory' error. The issue is rooted in the upstream XML parser used by SVGO, which does not handle custom XML entities by default. By enabling custom entities, attackers can exploit this feature to create small SVG files that expand exponentially during parsing, leading to severe performance degradation or application crashes.
How To Fix
Latest published version: 4.1.0 as of 23 Oct 2026
npm install svgo@4.1.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.1.0, < 2.8.12.8.1npm install svgo@2.8.1 -
>= 3.0.0, < 3.3.33.3.3npm install svgo@3.3.3 -
>= 4.0.0, < 4.0.14.0.1npm install svgo@4.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not feasible, users can implement a workaround by parsing the DOCTYPE directly and checking for the presence of custom entities. If any are found, they should be removed or escaped before passing the SVG to SVGO. Below is a code snippet demonstrating this workaround:
import SAX from 'sax';
import { optimize } from 'svgo';
let original = `
<?xml version="1.0"?>
<!DOCTYPE lolz [
<!ENTITY lol "lol">
<!ELEMENT lolz (#PCDATA)>
<!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
<!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
<!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
<!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
<!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
<!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
<!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
<!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
<!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<lolz>&lol9;</lolz>
`;
const parser = SAX.parser();
parser.ondoctype = (doctype) => {
original = original.replace(doctype, '');
};
parser.write(original);
optimize(original);
Conclusion
The SVGO vulnerability (CVE-2026-29074) poses a significant risk through entity expansion in DOCTYPE declarations, potentially leading to denial-of-service attacks. Users are advised to upgrade to the patched versions of SVGO or implement workarounds to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for svgo →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
SVGO versions from 2.1.0 to 3.3.2 and all versions prior to 4.0.1 are affected by this vulnerability.
If exploited, this vulnerability can lead to denial-of-service attacks, causing the application to stall or crash due to excessive memory usage.
While using SVGO locally on your own SVGs may not pose a risk, it is crucial to avoid processing untrusted input, such as user-uploaded SVGs, to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for svgo.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
