CVE-2026-121444

Name of the Vulnerable Software and Affected Versions svg-sanitizer versions 0.11.0 through 1.0.x

Description An algorithmic complexity issue exists in the use reference-graph analysis. An attacker can upload a small layered SVG containing 15 levels of fanned-out use elements, which triggers exponential path enumeration. This process consumes excessive resources and can pin PHP workers for several hours, leading to a denial of service. The issue is located within the hasInfiniteLoop() and countUse() functions.

Recommendations Update svg-sanitizer to version 1.1.0. As a temporary workaround, restrict the upload of SVG files containing deeply nested or layered use elements.