PT-2026-26757 · Unknown · @Resvg/Resvg-Js+1

Restriction · Published 2026-03-20 · Updated 2026-03-24 · CVE-2026-33418

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions @dicebear/converter versions prior to 9.4.2

Description The ensureSize() function in @dicebear/converter previously used a regex-based method to limit SVG width and height attributes to 2048px to prevent denial of service. This limitation could be bypassed by providing SVG input that caused the regex to incorrectly match a non-functional <svg tag before the actual SVG root element. When processed by @resvg/resvg-js on the Node.js code path, the SVG would render at the attacker-specified dimensions, potentially leading to out-of-memory crashes. The issue stemmed from using String.prototype.replace() with a non-global regex, which failed to distinguish between the actual SVG root element and other <svg occurrences within the input. The Node.js rendering path lacked a fitTo constraint in the renderAsync call, allowing unbounded rendering. The browser code path is not affected.

Recommendations Update to @dicebear/converter version 9.4.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-185

Related Identifiers

CVE-2026-33418

GHSA-7J2X-32W6-P43P

Affected Products

@Dicebear/Converter

@Resvg/Resvg-Js

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33418.json · Exploit
• https://github.com/dicebear/dicebear/security/advisories/GHSA-7j2x-32w6-p43p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33418 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33418 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7j2x-32w6-p43p · Vendor Advisory
• https://github.com/dicebear/dicebear · Note
• https://twitter.com/CVEnew/status/2036505785686171758 · Twitter Post