CVE-2026-29112: 
JavaScript vulnerability analysis and mitigation

CVE-2026-29112 is an uncontrolled memory allocation vulnerability in the @dicebear/converter npm package (part of the DiceBear avatar library) that allows unauthenticated remote attackers to cause denial of service by supplying a crafted SVG with extremely large width or height attributes. All versions of @dicebear/converter prior to 9.4.0 are affected. The vulnerability was reported by researcher maru1009, published by maintainer FlorianKoerner on March 3, 2026, and added to the GitHub Advisory Database on March 16, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, DiceBear Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerable ensureSize() function in packages/@dicebear/converter/src/utils/svg.ts parsed the width and height attributes directly from attacker-supplied SVG input and used those values to allocate the output canvas size for rasterization operations (toPng(), toJpeg(), toWebp(), toAvif()). By supplying an SVG with dimensions such as width="999999999", an attacker could force the server to attempt allocation of an enormous canvas buffer, exhausting available memory. No authentication or user interaction is required; the attacker only needs the ability to submit an SVG to an endpoint that passes it to the converter (GitHub Advisory, Patch Commit).

Successful exploitation causes excessive server-side memory allocation, leading to denial of service and potential service unavailability for all users of the affected application. The impact is limited to availability — there is no confidentiality or integrity impact. Only server-side applications that accept untrusted or user-supplied SVGs and pass them to the converter's rasterization functions are practically at risk; applications that exclusively convert self-generated DiceBear avatars face minimal practical exposure (GitHub Advisory, DiceBear Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038% (0.000380), placing it in the 20th percentile for exploitation probability within 30 days (GitHub Advisory). No threat actor attribution has been reported.

1. Identify a vulnerable target: Find a server-side application that accepts user-supplied SVG input and passes it to @dicebear/converter functions (toPng(), toJpeg(), toWebp(), or toAvif()) using a version prior to 9.4.0.
2. Craft a malicious SVG: Construct an SVG file with an extremely large width and/or height attribute, for example: <svg xmlns="http://www.w3.org/2000/svg" width="999999999" height="999999999"></svg>.
3. Submit the crafted SVG: Upload or POST the malicious SVG to the target application's SVG processing endpoint (e.g., an avatar upload or conversion API).
4. Trigger memory exhaustion: The server's ensureSize() function reads the oversized dimensions and attempts to allocate a canvas of that size, consuming all available memory and causing the Node.js process or server to crash or become unresponsive, resulting in denial of service for all users (GitHub Advisory, Patch Commit).

• Network: Repeated HTTP requests to SVG upload or conversion endpoints from the same source IP, particularly with large SVG payloads.
• Logs: Application or Node.js process logs showing out-of-memory (OOM) errors or crashes correlated with SVG conversion operations; entries referencing ensureSize() or canvas allocation failures.
• File System: Presence of SVG files with abnormally large width or height attribute values (e.g., width="999999999") in upload directories or temporary storage.
• Process: Node.js process memory usage spiking to system limits followed by process termination or restart events during SVG rasterization operations.

Upgrade @dicebear/converter to version 9.4.0 or later, which replaces the vulnerable ensureSize() behavior with a new size option (default: 512, maximum: 2048) that ignores SVG width/height attributes entirely; invalid values (NaN, negative, zero, Infinity) fall back to the default of 512 (DiceBear Release, Patch Commit). If immediate upgrading is not possible, validate and sanitize the width and height attributes of any untrusted SVG input before passing it to the converter, ensuring values are within acceptable bounds (GitHub Advisory). Applications that only process self-generated DiceBear avatars are not practically exploitable but should still upgrade as a best practice.

The vulnerability was disclosed responsibly by researcher maru1009 and patched promptly by DiceBear maintainer FlorianKoerner in the v9.4.0 release on March 3, 2026 (DiceBear Release). Brief community mentions appeared on Mastodon and Bluesky shortly after the advisory was published, but no significant broader media coverage or notable researcher commentary has been identified.