Skip to content
Threat Feed
Subscribe

Product

@Dicebear/Converter

1 brief RSS
medium advisory

DiceBear SVG Size Capping Bypass Leads to Denial of Service

A denial-of-service vulnerability exists in DiceBear versions prior to 9.4.2 due to a bypassable regex in the `ensureSize()` function, allowing attackers to craft SVGs that cause out-of-memory crashes during rendering on Node.js.

DiceBear +1 dos svg vulnerability
2r 1t