CVE-2026-29074: 
JavaScript vulnerability analysis and mitigation

CVE-2026-29074 is an XML Entity Expansion ("Billion Laughs") vulnerability in SVGO (SVG Optimizer), a Node.js library and CLI tool for optimizing SVG files. The flaw allows unauthenticated remote attackers to cause a denial of service by supplying a crafted SVG file containing recursive XML entity definitions in the DOCTYPE. Affected versions include 2.1.0 through 2.8.0, 3.0.0 through 3.3.2, and 4.0.0. It was disclosed on March 4, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, SVGO Advisory).

The root cause (CWE-776) lies in how SVGO extended the upstream sax XML parser: it pattern-matched custom XML entities from DOCTYPE declarations, inserted them into parser.ENTITIES, and enabled unparsedEntities to support SVGs with DOCTYPE-declared entities. However, because entities can reference other entities, a malicious SVG can define a chain of exponentially expanding entity references — the classic "Billion Laughs" attack — causing uncontrolled memory and CPU consumption. A proof-of-concept is publicly available in the advisory, demonstrating that an 811-byte SVG file is sufficient to stall or crash the Node.js process with a JavaScript heap out-of-memory error (GitHub Advisory, SVGO Advisory).

Successful exploitation results in a complete denial of service for any server-side application that processes user-supplied SVG files through SVGO. The Node.js process can be stalled indefinitely or crashed outright due to JavaScript heap exhaustion, with no impact on confidentiality or data integrity. Applications such as web platforms accepting SVG uploads — including those built on WordPress or other CMS frameworks — are particularly at risk, as a single sub-1 KB malicious file can take down the processing pipeline (GitHub Advisory, SVGO Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory and requires no authentication, no privileges, and no user interaction, making it trivially exploitable against any internet-facing service that processes untrusted SVG input with SVGO. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.04%, reflecting low current exploitation probability (GitHub Advisory, SVGO Advisory).

1. Identify target: Locate a web application or API endpoint that accepts SVG file uploads and processes them server-side using SVGO (versions 2.1.0–2.8.0, 3.0.0–3.3.2, or 4.0.0).
2. Craft malicious SVG: Create a small SVG file (~811 bytes) containing a DOCTYPE with recursive XML entity definitions ("Billion Laughs" pattern), such as:

<?xml version="1.0"?>
<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  ...
  <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<svg>&lol9;</svg>

3. Submit the file: Upload or POST the crafted SVG to the target endpoint (e.g., an image upload form or API).
4. Trigger DoS: SVGO's optimize() function attempts to parse and expand the entity chain, causing exponential memory consumption that stalls or crashes the Node.js process with a heap out-of-memory error (GitHub Advisory, SVGO Advisory).

• Logs: Node.js process logs showing FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory; application error logs recording crashes or timeouts during SVG processing.
• Network: Repeated HTTP requests uploading small SVG files (< 1 KB) to SVG processing endpoints; unusual frequency of upload requests from a single source IP.
• Process: Sudden spike in Node.js process memory consumption followed by process termination; application restart events triggered by process manager (e.g., PM2, systemd) shortly after SVG upload requests.
• File System: Presence of SVG files in upload directories containing DOCTYPE declarations with multiple nested entity definitions referencing each other (GitHub Advisory).

Upgrade SVGO to the patched versions: 2.8.1 (for 2.x users), 3.3.3 (for 3.x users), or 4.0.1 (for 4.x users); upgrading to v4 is strongly recommended as earlier branches are no longer officially supported. For SVGO v4.0.0 specifically, an alternative workaround is to recursively upgrade the sax dependency (e.g., yarn up -R sax) without upgrading SVGO itself. For v2/v3 users who cannot upgrade immediately, pre-parse the DOCTYPE using a SAX parser and strip or reject any SVG containing custom entity definitions before passing input to SVGO. Additionally, implement memory and CPU timeout limits around SVGO processing, and restrict SVG uploads from untrusted sources where possible (GitHub Advisory, SVGO Advisory).

The vulnerability was reported by researcher ByamB4 and credited to isaacs (maintainer of the sax parser), with the fix published by SethFalco on March 4, 2026. A WordPress core ticket (trac #64833) was opened to track the impact on WordPress, which bundles SVGO for SVG handling. IBM issued security bulletins for IBM Guardium Data Security Center and Cloudera Data Platform Private Cloud Base, and Red Hat issued multiple errata (RHSA-2026:6277, RHSA-2026:8490, RHSA-2026:8483, RHSA-2026:8493, RHSA-2026:9742, RHSA-2026:13512, RHSA-2026:13826, RHSA-2026:16535) addressing the vulnerability in their products. SUSE also released security updates (SUSE-SU-2026:2005-1, SUSE-SU-2026:2019-1) for affected packages (GitHub Advisory, IBM Advisory).