Read the docs
TI-2021-09948 Aliases CVE-2021-29059GHSA-r8j5-h5cx-65gg

A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular…

Priority LOW 38CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 9 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string.

Why it matters now

EPSS 0.02629 85th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial is-svg (npm): 4.3.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 9 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—is-svg (npm)2.1.0 to before 4.3.04.3.0Patch availableGHSA-r8j5-h5cx-65gg
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • is-svg (npm) Vendor— Affected 2.1.0 to before 4.3.0 Fixed in 4.3.0 Patch available GHSA-r8j5-h5cx-65gg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:is-svg_project:is-svg:*:*:*:*:*:node.js:*:*2.1.0 to before 4.3.0VulnerableIs-svg Project
  • cpe:2.3:a:is-svg_project:is-svg:*:*:*:*:*:node.js:*:* Versions 2.1.0 to before 4.3.0 Vulnerable ·Is-svg Project

Remediation

  • Fix · GHSA-r8j5-h5cx-65gg is-svg (npm) Fixed in 4.3.0 Advisory →

Red Hat 2 advisories

  • RHSA-2021:3759 Released 2021-10-18 · Red Hat rating Moderate
    OpenShift Container Platform 4.9.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.9 openshift4/ose-baremetal-rhel8-operator, openshift4/ose-console, openshift4/ose-etcd +4
  • RHSA-2021:2438 Released 2021-07-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.2 bug fix and security update
    • Red Hat OpenShift Container Platform 4.8 openshift4/driver-toolkit-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 1AffectedNo fix planned: Will not fix
OpenShift Service Mesh 2.0AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix planned: Will not fix
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat Quay 3AffectedNo fix planned: Will not fix
Red Hat Virtualization 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4.8Fixed RHSA-2021:2438
Red Hat OpenShift Container Platform 4.9Fixed RHSA-2021:3759
Not affected: 3 products
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat OpenShift Container Platform 4.8
  • Red Hat OpenShift Container Platform 4.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-29059
  2. 2026-10-03 Alias added: GHSA-r8j5-h5cx-65gg

References

Exploit 1

Advisory 3

Other 3

  • TI-2021-09337 The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences