CVE-2026-121445
Deferred Deferred - Pending Action

Regular Expression Denial of Service in svg-sanitizer

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens() when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU, or trigger PCRE limits causing sanitize() to throw a TypeError and leave unsanitized content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121445
EUVD
EUVD-2026-115867

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
darylldoyle svg-sanitizer 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Regular Expression Denial of Service (ReDoS) vulnerability in the darylldoyle svg-sanitizer library versions 1.0.0 to 1.0.1. It occurs in the image-set CSS stripping function when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU resources or trigger PCRE limits. This may cause sanitize() to throw a TypeError and leave unsanitized malicious content.

Detection Guidance

Check if your system uses svg-sanitizer versions 1.0.0 through 1.0.1 by inspecting installed packages or dependencies. Monitor CPU usage spikes when processing SVGs with image-set tokens. Test with crafted SVGs containing many unclosed image-set tokens to observe excessive processing time or errors.

Impact Analysis

The vulnerability can cause CPU exhaustion, making systems unresponsive or crashing services. It may also fail open, allowing malicious SVG content to bypass sanitization. A single crafted SVG under 1 MB could occupy a worker process for tens of seconds, disrupting services.

Mitigation Strategies

Upgrade svg-sanitizer to version 1.1.0 or later immediately. Disable the removeRemoteReferences option if possible. Implement input size limits for SVG processing and monitor for fail-open conditions where sanitization fails.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121445. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...