A critical vulnerability in the SVGO library allows unauthenticated attackers to crash the Node.js process by supplying maliciously crafted SVG files.

The application fails to properly restrict recursive XML entity expansion when processing SVG files. This lack of sanitization allows an unauthenticated attacker to trigger excessive memory consumption, leading to a crash of the Node.js process.

The exploitation of this vulnerability results in a denial of service for any application relying on SVGO for image processing. Given a CVSS score of 7.5, this flaw represents a significant availability risk, as it allows remote attackers to disrupt services with minimal effort. Organizations may face operational downtime and resource exhaustion that impacts legitimate user access.

Immediate Action: Update the SVGO package to version 2.8.1, 3.3.3, or 4.0.1 immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor application logs and server health metrics for sudden spikes in memory usage or frequent Node.js process restarts that may indicate exploitation attempts.

Compensating Controls: Implement input validation or XML parsing restrictions at the network edge or application layer to reject SVG files containing suspicious DTD definitions or large entity expansions.

Public Exploit Available: Unknown

The risk posed by this vulnerability is significant due to the ease of exploitation and the potential for service disruption. Security teams should prioritize updating the SVGO library across all development and production environments. Failing to patch will leave systems susceptible to simple, automated denial of service attacks that target the core memory management of the Node.js runtime.