CVE-2026-29112
📋 TL;DR
This vulnerability allows attackers to cause denial of service by supplying SVGs with extremely large dimensions to DiceBear's converter functions. Server-side applications that process untrusted SVGs through toPng(), toJpeg(), toWebp(), or toAvif() functions are affected. Applications only converting self-generated DiceBear avatars have minimal practical risk.
💻 Affected Systems
- DiceBear avatar library
- @dicebear/converter package
📦 What is this software?
Dicebear by Dicebear
⚠️ Risk & Real-World Impact
Worst Case
Complete server outage due to memory exhaustion, potentially affecting multiple services on the same host
Likely Case
Temporary service degradation or crashes of the specific application processing malicious SVGs
If Mitigated
No impact with proper input validation or upgraded version
🎯 Exploit Status
Exploitation requires ability to supply SVG files to vulnerable endpoints
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.4.0
Vendor Advisory: https://github.com/dicebear/dicebear/security/advisories/GHSA-v3r3-4qgc-vw66
Restart Required: No
Instructions:
Update package.json to require @dicebear/converter version 9.4.0 or higher
Run npm update @dicebear/converter
Restart application if using persistent processes
🔧 Temporary Workarounds
Input validation for SVG dimensions
allValidate width and height attributes of untrusted SVGs before processing
🧯 If You Can't Patch
- Implement strict input validation to reject SVGs with width/height exceeding reasonable limits (e.g., > 4096)
- Implement rate limiting on SVG processing endpoints to prevent mass exploitation
🔍 How to Verify
Check if Vulnerable:
Check package.json for @dicebear/converter version <9.4.0 or examine code for use of vulnerable converter functions with untrusted inputCheck Version:
npm list @dicebear/converterVerify Fix Applied:
Confirm @dicebear/converter version is 9.4.0+ and test with SVG containing large dimensions to ensure proper size limiting📡 Detection & Monitoring
Log Indicators:
- Memory exhaustion errors
- Process crashes during SVG processing
- Unusually large memory allocation patterns
Network Indicators:
- Multiple requests with SVG files to converter endpoints
- SVG files with extremely large width/height attributes in request payloads
SIEM Query:
source="application_logs" AND ("out of memory" OR "heap exhausted") AND "svg"