7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29074

CVE-2026-29074: SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29074

CVE-2026-29074:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
svgo	npm	>= 2.1.0, < 2.8.1	2.8.1
svgo	npm	>= 3.0.0, < 3.3.3	3.3.3
svgo	npm	= 4.0.0	4.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic 'Billion Laughs' XML entity expansion attack. SVGO, in its process of parsing SVG files, was susceptible to denial of service. The root cause was in the XML parsing logic, which did not properly restrict recursive entity references within the SVG's DOCTYPE. The analysis of the provided patches across three different major versions (v2, v3, and v4) consistently points to changes in lib/parser.js and the underlying sax dependency.

The function parseSvg in lib/parser.js is identified as the core vulnerable function. It is responsible for creating and configuring the SAX parser. Before the fix, it used a vulnerable version of the parser or configured it in a way that allowed for uncontrolled entity expansion. The patches address this by upgrading the sax dependency to a version that includes protections against this attack (e.g., limits on entity expansion depth and count) and ensuring the parser is configured correctly.

The optimize function, being the primary entry point of the SVGO library as demonstrated in the PoC, is the function that receives the untrusted input and initiates the parsing process by calling parseSvg. Therefore, it is a key runtime indicator for this vulnerability.

Vulnerable functions

parseSvg

lib/parser.js

The `parseSvg` function is responsible for parsing the input SVG string. It initializes the SAX parser and sets up various event handlers (e.g., `ondoctype`, `onopentag`). Before the patch, this function and its configuration of the XML parser were responsible for manually handling DOCTYPE entities, which lacked protection against recursive entity expansion (Billion Laughs attack). An attacker could provide a specially crafted SVG file that, when parsed by this function, would lead to excessive memory consumption and a denial of service. The patches replace the underlying parser and its configuration within this function to mitigate the vulnerability.

optimize

lib/svgo.js

The `optimize` function is the main public-facing API for SVGO and the entry point for processing SVG data. As shown in the proof-of-concept and the added test cases, this function is called with the malicious SVG string. It orchestrates the optimization process, which includes calling the vulnerable `parseSvg` function. Therefore, any runtime profile or stack trace during exploitation would show `optimize` as the initial function in the call chain that leads to the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.