CVE-2026-121444 in svg-sanitizer
Summary
by MITRE • 11/03/2026
svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration that pins PHP workers for hours.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The svg-sanitizer library, specifically versions prior to 1.1.0 and starting from version 0.11.0, contains a critical algorithmic complexity vulnerability within its SVG processing logic. This flaw is located in the functions responsible for analyzing use reference graphs, namely hasInfiniteLoop() and countUse(). These components are designed to detect circular references and count usage instances of graphical elements to ensure that processed SVGs do not contain infinite loops or excessive resource consumption during rendering. However, the underlying algorithm used for this analysis suffers from exponential time complexity when processing certain nested structures. This means that as the depth and branching factor of the use element hierarchy increase, the computational effort required does not grow linearly but rather explodes exponentially, leading to severe performance degradation.
The technical root cause lies in how the library traverses the SVG DOM tree to build and analyze the reference graph for use elements. When an attacker crafts a malicious SVG file with approximately fifteen levels of nested fanned-out use elements, the sanitizer's analysis routine attempts to enumerate all possible paths through this structure. Because each level can branch into multiple subsequent references, the number of potential paths grows factorially or exponentially relative to the depth of nesting. The hasInfiniteLoop() function likely employs a traversal method that does not efficiently memoize visited states or prune redundant branches early enough in deep hierarchies, causing it to revisit nodes and recalculate dependencies repeatedly. Similarly, countUse() may iterate through these paths without caching results for sub-trees, leading to massive redundancy in computation. This design flaw transforms what should be a linear-time operation into one that is computationally prohibitive even with relatively small file sizes.
The operational impact of this vulnerability is significant, particularly in environments where SVG sanitization occurs on the server side during user uploads or API requests. Attackers can exploit this by uploading specially crafted SVG files containing deeply nested use elements. Upon processing, these files trigger the exponential path enumeration described above, causing PHP workers to become pinned for extended periods. In a typical web application architecture using PHP-FPM or similar worker-based models, each request consumes one worker process. If that worker is stuck in an infinite-like loop due to high CPU usage from this algorithmic complexity, it cannot serve other legitimate requests. This effectively results in a Denial of Service condition for the entire service, as available workers are exhausted by malicious inputs. The effect is comparable to a classic ReDoS or resource exhaustion attack but achieved through structural manipulation rather than regex backtracking or memory allocation failures.
This vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, specifically falling under scenarios where algorithmic complexity leads to excessive CPU usage and time delays. From an offensive security perspective, this technique is consistent with ATT&CK tactic T1496, Resource Hijacking, as the attacker forces the system to consume disproportionate computational resources. It also relates to CWE-755, Improper Handling of Unusual Inputs, because the vulnerability is triggered by specific structural patterns in the input data that were not adequately constrained or optimized during development. The lack of depth limits or complexity checks on nested use elements allows this abuse vector to remain open until patched.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. Organizations using affected versions should immediately upgrade svg-sanitizer to version 1.1.0 or later, where the algorithmic flaw has been addressed through optimized graph traversal techniques such as memoization or iterative depth-first search with cycle detection that avoids redundant path enumeration. For systems unable to update instantly, implementing a strict limit on SVG nesting depth at the ingestion layer can prevent deeply nested structures from reaching the sanitizer. Additionally, introducing timeout mechanisms for PHP worker processes ensures that any single request consuming excessive CPU time is terminated before it impacts other users. Input validation should also be enhanced to reject SVGs with excessively complex use graphs based on heuristic metrics like node count or estimated path complexity prior to full sanitization processing.