CVE-2026-29074 is a denial of service vulnerability in SVGO caused by improper restriction of recursive entity references in XML DTDs (CWE-776). SVGO versions 2.1.0 through before 2.8.1, 3.0.0 through before 3.3.3, and all versions before 4.0.1 accept XML input with custom entities without guarding against entity expansion or recursion. This can lead to exponential data expansion, consuming excessive memory and crashing the Node.js process. The vulnerability is addressed in SVGO versions 2.8.1, 3.3.3, and 4.0.1. Red Hat advisories confirm the impact and provide details on affected products and mitigation status.

An attacker can cause a denial of service by submitting a crafted XML file that triggers recursive entity expansion, leading to high memory consumption and crashing the Node.js process running SVGO. There is no impact on confidentiality or integrity, but availability is severely affected.

Official patches are available in SVGO versions 2.8.1, 3.3.3, and 4.0.1. Users should upgrade to these or later versions to remediate the vulnerability. The Red Hat advisory notes that no alternative mitigations meet their criteria for ease of use and applicability, so upgrading is the recommended action.