7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29112

CVE-2026-29112: @dicebear/converter vulnerable to ncontrolled memory allocation via crafted SVG dimensions

DiceBear is an avatar library for designers and developers. Prior to version 9.4.0, the ensureSize() function in @dicebear/converter read the width and height attributes from the input SVG to determine the output canvas size for rasterization (PNG, JPEG, WebP, AVIF). An attacker who can supply a crafted SVG with extremely large dimensions (e.g. width="999999999") could force the server to allocate excessive memory, leading to denial of service. This primarily affects server-side applications that pass untrusted or user-supplied SVGs to the converter's toPng(), toJpeg(), toWebp(), or toAvif() functions. Applications that only convert self-generated DiceBear avatars are not practically exploitable, but are still recommended to upgrade. This is fixed in version 9.4.0. The ensureSize() function no longer reads SVG attributes to determine output size. Instead, a new size option (default: 512, max: 2048) controls the output dimensions. Invalid values (NaN, negative, zero, Infinity) fall back to the default. If upgrading is not immediately possible, validate and sanitize the width and height attributes of any untrusted SVG input before passing it to the converter.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29112

CVE-2026-29112:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@dicebear/converter	npm	< 9.4.0	9.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an uncontrolled memory allocation issue in the @dicebear/converter package. The root cause lies in the ensureSize function, located in packages/@dicebear/converter/src/utils/svg.ts. Before the patch, this function would parse the width attribute directly from the input SVG string without any validation. The extracted value was then used by the toCanvas function in packages/@dicebear/converter/src/core.ts to set the dimensions of a new canvas element. An attacker could exploit this by providing a crafted SVG with an extremely large width attribute, causing the toCanvas function to attempt a massive memory allocation, which would lead to a Denial of Service (DoS).

The patch, identified in commit 42a59eac46a3c68598859e608ec45e578b27614a, rectifies this by completely changing the logic. The ensureSize function no longer reads the dimensions from the SVG. Instead, it accepts a size parameter, which is sanitized to ensure it's within a safe range (defaulting to 512 and capped at 2048), and then overwrites the width and height attributes in the SVG. The public-facing functions (toPng, toJpeg, etc.) were updated to accept this new size option. Any runtime profile of an exploit would show a call chain originating from one of these export functions, leading to toCanvas and finally ensureSize.

Vulnerable functions

ensureSize

packages/@dicebear/converter/src/utils/svg.ts

This function was vulnerable because it parsed the 'width' attribute from the user-provided SVG without any validation. The extracted value was then used to determine the canvas size for image conversion. An attacker could provide an SVG with an extremely large width, causing the application to allocate excessive memory, leading to a Denial of Service.

toCanvas

packages/@dicebear/converter/src/core.ts

This function calls the vulnerable `ensureSize` function and uses the returned 'size' to create an HTMLCanvasElement. It is the function that directly performs the excessive memory allocation based on the malicious dimensions parsed from the SVG, making it a key part of the vulnerability.

toPng

packages/@dicebear/converter/src/core.ts

This is a public-facing API function that serves as an entry point for the vulnerability. It takes user-provided SVG data and passes it down to the vulnerable conversion logic. During an exploit, this function would be at the top of the call stack.

toJpeg

packages/@dicebear/converter/src/core.ts

toWebp

packages/@dicebear/converter/src/core.ts

toAvif

packages/@dicebear/converter/src/core.ts

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.