CVE-2026-29074
EUVD-2026-1002206.03.2026, 08:16
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| svgo | svgo | 2.1.0 ≤ 𝑥 < 2.8.1 |
| svgo | svgo | 3.0.0 ≤ 𝑥 < 3.3.3 |
| svgo | svgo | 4.0.0 ≤ 𝑥 < 4.0.1 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:2.5.20260422-2.el8ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:2.5.20260422-2.el9ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:2.6.7-1.el9ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.8 | 1775594119 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.5 | 1777403872 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1777387242 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1774243862 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.8 | 1776784286 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.9 | 1777903262 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.16 | 1774282136 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.25 | 1780467029 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.25 | 1780467147 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1779189627 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778473763 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778666987 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 | 1779814592 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 2.6 | 1776191302 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3 | 1776151124 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3 | 1776151272 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.1 | 1776151106 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.1 | 1776151270 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.2 | 1776155669 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.2 | 1776149682 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.3 | 1776151134 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.3 | 1776151277 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.10 | 1776736910 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.12 | 1776752646 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.14 | 1779689392 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.15 | 1775169219 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.16 | 1779204086 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.17 | 1779922205 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.9 | 1775169218 ≤ 𝑥 < * | ADP |
References