---
id: CVE-2026-121444
title: >-
  svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference
  Graph
summary: >-
  svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity
  denial of service vulnerability in hasInfiniteLoop() and countUse() of the use
  reference-graph analysis. Attackers can upload a small layered SVG with 15
  levels of…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-400
vendor: darylldoyle
product: svg-sanitizer
affected:
  - svg-sanitizer >= 0.11.0 < 1.1.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-03T17:51:45.914713Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T18:28:41.671Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121444'
references:
  - url: >-
      https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-hrwm-vcc9-hcm4
    label: GitHub Security Advisory (GHSA-hrwm-vcc9-hcm4)
  - url: >-
      https://www.vulncheck.com/advisories/svg-sanitizer-0.11.0-before-1.1.0-algorithmic-complexity-dos-via-use-reference-graph
    label: >-
      VulnCheck Advisory: svg-sanitizer 0.11.0 before 1.1.0 Algorithmic
      Complexity DoS via use Reference Graph
tags:
  - cve.org
epss: 0.00417
epssPercentile: 0.36249
ingestedAt: '2026-11-05T20:33:06.354Z'
---

## Overview

svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration that pins PHP workers for hours.

## Affected

- `svg-sanitizer >= 0.11.0 < 1.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.