CVE-2026-33418: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33418 is a denial-of-service vulnerability in the @dicebear/converter npm package, caused by an SVG dimension capping bypass via XML comment injection in the ensureSize() function. It affects all versions of @dicebear/converter up to and including 9.4.1, and was disclosed on March 19, 2026, with a patch released in version 9.4.2. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), reflecting its network-accessible, no-privilege, no-interaction attack vector with high availability impact (GitHub Advisory, DiceBear Advisory).

The root cause is an incorrect regular expression (CWE-185) in the ensureSize() function, which was designed to cap SVG width/height attributes at 2048px to prevent resource exhaustion. An attacker can craft SVG input containing a decoy <svg string — for example, embedded within an XML comment — that causes the regex to match and rewrite a non-functional occurrence of the SVG opening tag, leaving the actual root element's dimensions untouched. When the malformed SVG is subsequently rendered via @resvg/resvg-js on the Node.js code path (used by conversion functions toPng, toJpeg, toWebp, and toAvif), it renders at the attacker-specified dimensions, potentially allocating excessive memory. The browser-based code path is not affected (GitHub Advisory, DiceBear Advisory).

Successful exploitation allows an unauthenticated remote attacker to trigger out-of-memory crashes on Node.js servers processing untrusted SVG content through DiceBear's image conversion pipeline. This results in a complete loss of availability for the affected service, with no impact on confidentiality or integrity. Applications that accept user-supplied SVG input and pass it through @dicebear/converter's toPng, toJpeg, toWebp, or toAvif functions on the server side are at risk of repeated service crashes (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.044%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication or user interaction, lowering the barrier for exploitation against exposed Node.js services (GitHub Advisory).

1. Identify target: Locate a web application or API that uses @dicebear/converter versions ≤ 9.4.1 on a Node.js backend and accepts user-controlled SVG input for conversion (e.g., avatar generation endpoints).
2. Craft malicious SVG: Construct an SVG payload that includes a decoy <svg string (e.g., inside an XML comment such as <!-- <svg width="100" height="100"> -->) before the actual SVG root element, which carries extremely large width/height values (e.g., width="99999999" height="99999999").
3. Submit payload: Send the crafted SVG to the target endpoint that invokes toPng(), toJpeg(), toWebp(), or toAvif() — the regex in ensureSize() matches the decoy <svg tag and rewrites it, leaving the real root element's oversized dimensions intact.
4. Trigger rendering: The @resvg/resvg-js renderer processes the SVG at the attacker-specified dimensions, causing excessive memory allocation on the Node.js server.
5. Achieve denial of service: Repeated requests with such payloads exhaust server memory, causing out-of-memory crashes and service unavailability (GitHub Advisory, DiceBear Advisory).

• Network: Repeated HTTP requests to avatar generation or SVG conversion endpoints containing SVG payloads with unusually large width/height attribute values or XML comments containing <svg strings.
• Logs: Application logs showing repeated crashes or out-of-memory (OOM) errors in Node.js processes handling image conversion; error traces referencing @resvg/resvg-js or @dicebear/converter.
• Process: Node.js worker processes consuming abnormally high memory before crashing; frequent process restarts by process managers (e.g., PM2, systemd) for the affected service.

Upgrade @dicebear/converter to version 9.4.2 or later, which replaces the flawed regex-based approach with XML-aware processing using fast-xml-parser to correctly identify and modify the SVG root element's attributes. Additionally, version 9.4.2 adds a fitTo constraint to the renderAsync call as a defense-in-depth measure, ensuring rendered output is always bounded regardless of SVG content. As a temporary workaround prior to patching, applications should validate and sanitize SVG input server-side before passing it to conversion functions, rejecting inputs with excessively large dimension values (GitHub Advisory, DiceBear Advisory).

The vulnerability was published by DiceBear maintainer FlorianKoerner on March 19, 2026, via a GitHub Security Advisory. Coverage was noted on security aggregation platforms including GitLab Advisories, VulDB, and CVEFeed shortly after disclosure. Social media activity was limited, with a brief mention on Bluesky by the CyberHub blog. No significant vendor statements beyond the official advisory or notable researcher commentary have been identified (DiceBear Advisory).