Live › vulnerability › CVE-2026-121445
The svg-sanitizer npm package has a regular expression denial of service flaw in its remote CSS token stripping when removeRemoteReferences is enabled. Crafted SVGs with many unclosed image-set tokens can exhaust CPU, or make sanitize() throw and return unsanitized content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Applications that use svg-sanitizer from 1.0.0 before 1.1.0 to clean user-uploaded SVGs, especially with removeRemoteReferences enabled. Apps that do not sanitize untrusted SVGs or do not use that option are less exposed. The sources do not say how the sanitize() exception path is handled by callers.
No product ranges from the sources yet.
svg-sanitizer in your lockfile or with npm ls svg-sanitizersanitize() with removeRemoteReferences enabled on user-supplied SVGssvg-sanitizer move to 1.1.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens() when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU, or trigger PCRE limits causing sanitize() to throw a TypeError and leave unsanitized content.
This page as .md · .json · in your agent: get_signal("CVE-2026-121445")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.