CVE-2026-33418

CVE-2026-33418 is a high-severity denial-of-service vulnerability affecting DiceBear avatar library versions prior to 9.4.2, specifically its `@dicebear/converter` component. An attacker can bypass a regex-based SVG size cap by crafting a malicious SVG, leading to the rendering of oversized images and potential out-of-memory crashes when processed on Node.js. Rated 7.5 HIGH on CVSS, this vulnerability has a network attack vector with low attack complexity, allowing unauthenticated attackers to cause a denial of service. There is currently no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed on CISA's KEV catalog.