SVGO, a Node.js library that optimizes SVG files, parses XML with custom entities without limiting expansion. The flaw allows an attacker to supply a deceptively small XML document that expands multiple times, exhausting the JavaScript heap and causing the application to stall or crash. This results in a denial‑of‑service condition for any process that uses SVGO to optimize SVG input.

The vulnerability affects the SVGO Node.js library and command‑line tool. Versions 2.1.0 through 2.8.0, 3.0.0 through 3.3.2, and any 4.0.0 prior to 4.0.1 are impacted. The issue was fixed in version 2.8.1, 3.3.3, and 4.0.1.

This vulnerability carries a CVSS score of 7.5 and an EPSS under 1 %, indicating a high severity but a low likelihood of widespread exploitation. It is not listed in the CISA KEV catalog. The exploitation path typically involves an attacker supplying a crafted SVG file to an application that processes SVG via SVGO. Successful exploitation leads to memory exhaustion and a process crash, effectively denying service to legitimate users.