CVE-2026-29074Disclosure(svgo / svgo)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.

svgo CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673

Other references

Weakness type (CWE)

CWE-776

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

svgo

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 2 classified signals
Peaked 1d ago at 3 mentions (2026-03-06); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

svgo

Products

svgo

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

250.0%

General

250.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-06	3	Disclosure2General1
2026-03-11	1	General1

Full discourse4 posts

CRAC Learning - Tech@cracbot211d
General
CVE-2026-29074 (CVSS:7.5, HIGH) is Analyzed. SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version ..https://nvd.nist.gov/vuln/detail/CVE-2026-29074 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post references CVE‑2026‑29074, noting its CVSS score and the affected library, but provides no evidence of a PoC, exploit, active exploitation, patch, or detailed vulnerability type.
0000058
172 followersView on X
CVE@CVEnew216d
General
CVE-2026-29074 SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.… https://www.cve.org/CVERecord?id=CVE-2026-29074
Post summary
The post simply references CVE-2026-29074 with a link to its CVE record, providing no further technical or exploit details.
00000122
56.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds216d
Disclosure
CVE-2026-29074 XML External Entity (XXE) Denial of Service in SVGO Library Versions 2.1.0-2.8.0, 3.0.0-3.3.2, and Before 4.0.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-29074
Post summary
The text announces CVE‑2026‑29074, an XXE-based denial‑of‑service flaw affecting multiple SVGO library versions, and provides a link to further details.
0000040
4.0K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash216d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-29074 - SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs) Intel Report: https://ift.tt/hn4TDFq
Post summary
An alert identifies CVE-2026-29074 as a denial‑of‑service flaw in SVGO caused by entity expansion in DOCTYPE, but provides no PoC, exploit, active use, patch, or false‑positive information.
0000033
343 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	svgo	svgo	-	node.js	-

Explore more

Back to dashboard svgo CVEs svgo vulnerabilities

What researchers are saying

CVE-2026-29074

CRAC Learning - Tech@cracbotGeneral

The post references CVE‑2026‑29074, noting its CVSS score and the affected library, but provides no evidence of a PoC, exploit, active exploitation, patch, or detailed vulnerability type.

CVE@CVEnewGeneral

The post simply references CVE-2026-29074 with a link to its CVE record, providing no further technical or exploit details.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces CVE‑2026‑29074, an XXE-based denial‑of‑service flaw affecting multiple SVGO library versions, and provides a link to further details.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

An alert identifies CVE-2026-29074 as a denial‑of‑service flaw in SVGO caused by entity expansion in DOCTYPE, but provides no PoC, exploit, active use, patch, or false‑positive information.