ZeroDay Findings
Sign inSign up

Findings

CVE-2026-33418

DiceBear is an avatar library for designers and developers.

Published Mar 24, 2026 · updated Jun 17, 2026 · dicebear dicebear

DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the function in used a regex-based approach to rewrite SVG / attributes, capping them at 2048px to prevent denial of service. This size capping could be bypassed by crafting SVG input that causes the regex to match a non-functional occurrence of before the actual SVG root element. When the SVG is subsequently rendered via on the Node.js code path, it renders at the attacker-specified dimensions, potentially causing out-of-memory crashes. In version 9.4.2, the regex-based approach has been replaced with XML-aware processing using to correctly identify and modify the SVG root element's attributes. Additionally, a constraint has been added to the call as defense-in-depth, ensuring the rendered output is always bounded regardless of SVG content.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 24, 2026 · NIST NVD

    Detected

    DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the function in used a regex-based approach to rewrite SVG / attributes, capping them at 2048px to prevent denial of service. This size capping could be bypassed by crafting SVG input that causes the regex to match a non-functional occurrence of before the actual SVG root element. When the SVG is subsequently rende

  2. Jun 17, 2026 · NIST NVD

    Updated

    DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the function in used a regex-based approach to rewrite SVG / attributes, capping them at 2048px to prevent denial of service. This size capping could be bypassed by crafting SVG input that causes the regex to match a non-functional occurrence of before the actual SVG root element. When the SVG is subsequently rende

Affected

  • cpe dicebear/dicebearversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-33418

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-33418

    DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the function in used a regex-based approach to rewrite SVG / attributes, capping them at 2048px to prevent denial of service. This size capping

    nvd.nist.gov

References