CVE-2026-29112: Uncontrolled Memory Allocation in @dicebear/converter Due to SVG Dimension Handling
Summary
CVE-2026-29112: Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter. Affects @dicebear/converter versions < 9.4.0. Fixed in 9.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @dicebear/converter package is a widely used tool for converting SVG images into various raster formats such as PNG, JPEG, WebP, and AVIF. It is particularly popular in applications that generate avatars and other graphical elements dynamically. However, its handling of SVG dimensions can lead to significant vulnerabilities if untrusted input is processed, making it critical for developers to ensure proper validation and sanitization of SVG attributes.
Vulnerability Detail
The vulnerability arises from the ensureSize() function in @dicebear/converter versions prior to 9.4.0, which reads width and height attributes from input SVG files to determine the output canvas size. An attacker can exploit this by supplying a crafted SVG with excessively large dimensions, such as width="999999999", leading to uncontrolled memory allocation. This can result in denial of service (DoS) for server-side applications that process untrusted SVGs, as the server may allocate excessive memory resources, potentially crashing the application.
How To Fix
Minimum fixed version
9.4.0
This is the first release that contains the fix.
npm install @dicebear/converter@9.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, you can implement a workaround by validating and sanitizing the width and height attributes of any untrusted SVG input before passing it to the converter. For example, you can use the following code snippet to ensure that the dimensions are within acceptable limits:
function validateSvgDimensions(svg) {
const width = parseInt(svg.width, 10);
const height = parseInt(svg.height, 10);
if (isNaN(width) || isNaN(height) || width <= 0 || height <= 0 || width > 2048 || height > 2048) {
throw new Error('Invalid SVG dimensions');
}
return svg;
}
Conclusion
In summary, CVE-2026-29112 poses a significant risk to applications using the @dicebear/converter package due to uncontrolled memory allocation from untrusted SVG inputs. It is crucial to update to version 9.4.0 or later to mitigate this vulnerability. If immediate upgrading is not possible, implementing proper validation and sanitization of SVG dimensions is essential.
See every vulnerability recorded for @dicebear/converter →
FAQ
CVE-2026-29112 is a vulnerability in the @dicebear/converter package that allows for uncontrolled memory allocation due to improper handling of SVG dimensions.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any installation.
The main consequence is denial of service (DoS), where an attacker can cause the server to allocate excessive memory, potentially crashing the application.
You can update the package by running the command: npm install @dicebear/converter@^9.4.0 in your project directory.
If you cannot upgrade immediately, validate and sanitize the SVG dimensions before processing them with the converter to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for @dicebear/converter.
