The @dicebear/converter library is vulnerable to a denial of service attack that can be triggered by unauthenticated remote actors providing maliciously crafted SVG files.

This vulnerability, categorized as CWE-770 (Allocation of Resources Without Limits or Throttling), exists within the ensureSize() function. An unauthenticated attacker can supply an SVG with extremely large width and height attributes, forcing the server to allocate excessive memory during rasterization and leading to a crash.

The potential for a denial of service attack against server-side applications can result in significant downtime for services relying on user-generated avatar processing. With a CVSS score of 7.5, the vulnerability is classified as High severity, as it is fully automatable and does not require any user interaction or authentication to trigger.

Immediate Action: Update the @dicebear/converter package to version 9.4.0 or later immediately.

Proactive Monitoring: Monitor server memory usage and application logs for unusual spikes or errors associated with image processing functions.

Compensating Controls: If an immediate update is not feasible, implement strict input validation to sanitize and limit the width and height attributes of any untrusted SVG files before passing them to the converter functions.

Public Exploit Available: Unknown

Given the ease with which this vulnerability can be exploited by unauthenticated remote attackers, organizations should prioritize updating the affected library. We recommend verifying all dependencies to ensure version 9.4.0 is deployed across all production environments to eliminate the risk of memory-exhaustion-based denial of service attacks.