GHSA-v3r3-4qgc-vw66

Source

https://github.com/advisories/GHSA-v3r3-4qgc-vw66

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-v3r3-4qgc-vw66/GHSA-v3r3-4qgc-vw66.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-v3r3-4qgc-vw66

Aliases

CVE-2026-29112

Published

2026-03-16T16:15:33Z

Modified

2026-03-19T21:17:23Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter

Details

Impact

The ensureSize() function in @dicebear/converter (versions < 9.4.0) read the width and height attributes from the input SVG to determine the output canvas size for rasterization (PNG, JPEG, WebP, AVIF). An attacker who can supply a crafted SVG with extremely large dimensions (e.g. width="999999999") could force the server to allocate excessive memory, leading to denial of service.

This primarily affects server-side applications that pass untrusted or user-supplied SVGs to the converter's toPng(), toJpeg(), toWebp(), or toAvif() functions. Applications that only convert self-generated DiceBear avatars are not practically exploitable, but are still recommended to upgrade.

Patches

Fixed in version 9.4.0. The ensureSize() function no longer reads SVG attributes to determine output size. Instead, a new size option (default: 512, max: 2048) controls the output dimensions. Invalid values (NaN, negative, zero, Infinity) fall back to the default.

Workarounds

If upgrading is not immediately possible, validate and sanitize the width and height attributes of any untrusted SVG input before passing it to the converter.

Database specific

{
    "cwe_ids":  [
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-16T16:15:33Z",
    "nvd_published_at":  "2026-03-18T04:17:16Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / @dicebear/converter

Package

Name: @dicebear/converter; View open source insights on deps.dev
Purl: pkg:npm/%40dicebear/converter

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.4.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-v3r3-4qgc-vw66/GHSA-v3r3-4qgc-vw66.json"