SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)
Priority MEDIUM 40CWE-776Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 25 fixed, 12 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00702 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial svgo (svg): 2.8.1, 3.3.3svgo (npm): 2.8.1, 3.3.3, 4.0.1Red Hat: 26 advisoriesRed Hat: 25 fixed, 12 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| svg | svgo | 2.1.0 to before 2.8.1; 3.0.0 to before 3.3.3; = 4.0.0 | 2.8.1, 3.3.3 | Patch available | CNA |
| — | svgo (npm) | 2.1.0 to before 2.8.1 | 2.8.1 | Patch available | GHSA-xpqw-6gx7-v673 |
| — | svgo (npm) | 3.0.0 to before 3.3.3 | 3.3.3 | Patch available | GHSA-xpqw-6gx7-v673 |
| — | svgo (npm) | 4.0.0 to before 4.0.1 | 4.0.1 | Patch available | GHSA-xpqw-6gx7-v673 |
- svgo Vendorsvg Affected 2.1.0 to before 2.8.1; 3.0.0 to before 3.3.3; = 4.0.0 Fixed in 2.8.1, 3.3.3 Patch available CNA
- svgo (npm) Vendor— Affected 2.1.0 to before 2.8.1 Fixed in 2.8.1 Patch available GHSA-xpqw-6gx7-v673
- svgo (npm) Vendor— Affected 3.0.0 to before 3.3.3 Fixed in 3.3.3 Patch available GHSA-xpqw-6gx7-v673
- svgo (npm) Vendor— Affected 4.0.0 to before 4.0.1 Fixed in 4.0.1 Patch available GHSA-xpqw-6gx7-v673
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:svgo:svgo:*:*:*:*:*:node.js:*:* | 2.1.0 to before 2.8.1; 3.0.0 to before 3.3.3; 4.0.0 to before 4.0.1 | Vulnerable | Svgo |
- cpe:2.3:a:svgo:svgo:*:*:*:*:*:node.js:*:* Versions 2.1.0 to before 2.8.1; 3.0.0 to before 3.3.3; 4.0.0 to before 4.0.1 Vulnerable ·Svgo
Remediation
- Fix · CNA svgo (svg) Fixed in 2.8.1, 3.3.3
- Fix · GHSA-xpqw-6gx7-v673 svgo (npm) Fixed in 2.8.1 Advisory →
- Fix · GHSA-xpqw-6gx7-v673 svgo (npm) Fixed in 3.3.3 Advisory →
- Fix · GHSA-xpqw-6gx7-v673 svgo (npm) Fixed in 4.0.1 Advisory →
Red Hat 26 advisories
- RHSA-2026:48085 Released 2026-07-29 · Red Hat rating ImportantRed Hat Quay 3.18.0
- Red Hat Quay 3.18 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:24977 Released 2026-06-10 · Red Hat rating ImportantRHOAI 2.25.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +34
- RHSA-2026:22465 Released 2026-06-02 · Red Hat rating ImportantRed Hat Quay 3.17.2
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
Show 23 more Red Hat advisories
- RHSA-2026:21772 Released 2026-05-28 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.28.0 Release.
- Red Hat OpenShift Dev Spaces 3.28 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +3
- RHSA-2026:21017 Released 2026-05-26 · Red Hat rating ImportantRed Hat Quay 3.14.8
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:19712 Released 2026-05-20 · Red Hat rating CriticalRHOAI 3.3.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +33
- RHSA-2026:19375 Released 2026-05-19 · Red Hat rating ImportantRed Hat Quay 3.16.4
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:13826 Released 2026-05-05 · Red Hat rating CriticalRed Hat Developer Hub 1.9.4 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:13553 Released 2026-05-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Container Release Update
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/ee-supported-rhel8, registry.redhat.io/ansible-automation-platform-25/gateway-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8 +2
- RHSA-2026:13545 Released 2026-05-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9 +11
- RHSA-2026:13512 Released 2026-05-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.28-3.el8ap, automation-gateway-proxy-2.5.10-5.el8ap, automation-gateway-proxy-server-2.5.10-5.el8ap +19
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.28-3.el9ap, automation-gateway-proxy-2.6.14-2.el9, automation-gateway-proxy-server-2.6.14-2.el9 +19
- RHSA-2026:11916 Released 2026-04-29 · Red Hat rating ImportantRed Hat Quay 3.10.21
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:11856 Released 2026-04-29 · Red Hat rating ImportantRed Hat Quay 3.12.17
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:9742 Released 2026-04-22 · Red Hat rating CriticalRed Hat Developer Hub 1.8.6 release.
- Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:8493 Released 2026-04-16 · Red Hat rating CriticalKiali 2.22.2 for Red Hat OpenShift Service Mesh 3.3
- Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:8491 Released 2026-04-16 · Red Hat rating CriticalKiali 2.17.6 for Red Hat OpenShift Service Mesh 3.2
- Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:8490 Released 2026-04-16 · Red Hat rating CriticalKiali 2.11.9 for Red Hat OpenShift Service Mesh 3.1
- Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:8484 Released 2026-04-16 · Red Hat rating CriticalKiali 2.4.15 for Red Hat OpenShift Service Mesh 3.0
- Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:8483 Released 2026-04-16 · Red Hat rating CriticalKiali 1.73.29 for Red Hat OpenShift Service Mesh 2.6
- Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8, registry.redhat.io/openshift-service-mesh/kiali-rhel8
- RHSA-2026:7110 Released 2026-04-08 · Red Hat rating ImportantRHACS 4.8.10 security and bug fix update
- Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
- RHSA-2026:6926 Released 2026-04-07 · Red Hat rating ImportantRed Hat Quay 3.9.20
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:6568 Released 2026-04-03 · Red Hat rating ImportantRed Hat Quay 3.15.4
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:6404 Released 2026-04-01 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/gateway-rhel9, registry.redhat.io/ansible-automation-platform-26/hub-rhel9, registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9 +2
- RHSA-2026:6309 Released 2026-03-31 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/gateway-rhel9, registry.redhat.io/ansible-automation-platform-26/hub-rhel9, registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9 +2
- RHSA-2026:6277 Released 2026-03-31 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-gateway-proxy-2.6.14-1.el9, automation-gateway-proxy-server-2.6.14-1.el9, automation-platform-ui-2.6.7-1.el9ap +1
- RHSA-2026:5807 Released 2026-03-25 · Red Hat rating ImportantRHOAI 2.16.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +12
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix planned: Will not fix |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Self-service automation portal 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 4.8 | Fixed | RHSA-2026:7110 |
| Red Hat Ansible Automation Platform 2.5 | Fixed | RHSA-2026:13553 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:13545, RHSA-2026:6309 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2026:6277 |
| Red Hat Developer Hub 1.8 | Fixed | RHSA-2026:9742 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:13826 |
| Red Hat OpenShift AI 2.16 | Fixed | RHSA-2026:5807 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:24977 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:19712 |
| Red Hat OpenShift Dev Spaces 3.28 | Fixed | RHSA-2026:21772 |
| Red Hat OpenShift Service Mesh 2.6 | Fixed | RHSA-2026:8483 |
| Red Hat OpenShift Service Mesh 3.0 | Fixed | RHSA-2026:8484 |
| Red Hat OpenShift Service Mesh 3.1 | Fixed | RHSA-2026:8490 |
| Red Hat OpenShift Service Mesh 3.2 | Fixed | RHSA-2026:8491 |
| Red Hat OpenShift Service Mesh 3.3 | Fixed | RHSA-2026:8493 |
| Red Hat Quay 3.10 | Fixed | RHSA-2026:11916 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:11856 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:21017 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:6568 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:19375 |
| Red Hat Quay 3.17 | Fixed | RHSA-2026:22465 |
| Red Hat Quay 3.18 | Fixed | RHSA-2026:48085 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:6926 |
Not affected: 36 products
- Gatekeeper 3
- Multicluster Engine for Kubernetes
- OpenShift Service Mesh 3
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4.8
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.6 for RHEL 10
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Developer Hub 1.8
- Red Hat Developer Hub 1.9
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI 2.16
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Spaces 3.28
- Red Hat OpenShift Service Mesh 2.6
- Red Hat OpenShift Service Mesh 3.3
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.14
- Red Hat Quay 3.15
- Red Hat Quay 3.16
- Red Hat Quay 3.17
- Red Hat Quay 3.18
- Red Hat Quay 3.9
- Red Hat build of OptaPlanner 8
Timeline
- 2026-10-02 Threatist record created from CVE-2026-29074
- 2026-10-03 Alias added: GHSA-xpqw-6gx7-v673
References
More svg vulnerabilities
- TI-2026-51734 SVGO: removeScripts plugin leaves some executable scripts intact CVSS 3.1HIGH 8.2
- TI-2026-57981 SVGO: removeScripts allows executable links through namespace and control-character bypasses CVSS 3.1HIGH 8.2
- TI-2026-57980 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-29074 · CVE Program
- CVE-2026-29074 · NVD
- FIRST EPSS
- GHSA-xpqw-6gx7-v673 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-29074 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences