The DiceBear avatar library is vulnerable to a denial of service attack in versions prior to 9.4.2, which allows attackers to trigger memory exhaustion by bypassing SVG dimension constraints.

The vulnerability exists in the ensureSize function, which uses an insecure regular expression to parse SVG width and height attributes. An unauthenticated attacker can craft malicious SVG input to bypass these checks, forcing the underlying @resvg/resvg-js engine to render images at uncontrolled dimensions.

The flaw carries a CVSS score of 7.5, indicating a high risk of service disruption. Successful exploitation allows an attacker to induce out-of-memory crashes on the server, resulting in application downtime and potential degradation of services dependent on this library. This poses a significant threat to availability for platforms that process user-supplied SVG avatars.

Immediate Action: Update the @dicebear/converter package to version 9.4.2 or later to implement XML-aware parsing and robust size constraints.

Proactive Monitoring: Monitor application server logs for frequent process restarts or memory usage spikes that may indicate attempts to trigger the out-of-memory condition.

Compensating Controls: Implement strict input validation or sanitization layers for all user-supplied SVG files before they reach the @dicebear/converter processing pipeline.

Public Exploit Available: Unknown

Given the potential for denial of service and the ease of triggering this flaw, organizations should prioritize upgrading their dependencies immediately. Ensuring the transition to version 9.4.2 is critical to remediating the underlying regex-based parsing logic and protecting the application infrastructure from memory exhaustion attacks.