CVE-2026-29074 is a denial-of-service vulnerability in SVGO, a Node.js SVG optimization tool, caused by improper restriction of recursive XML entity references in DTDs (CWE-776). Affected SVGO versions (>=2.1.0 <2.8.1, >=3.0.0 <3.3.3, and <4.0.1) accept XML input with custom entities without safeguards against entity expansion or recursion. This can lead to excessive memory consumption and crash the Node.js process. The vulnerability has been patched in versions 2.8.1, 3.3.3, and 4.0.1. Red Hat advisories provide official fixes for affected distributions embedding SVGO. The CVSS 3.1 vector indicates network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability (score 7.5).

The vulnerability allows an attacker to cause a denial of service by submitting a crafted SVG file containing recursive XML entity references. This can stall the SVGO application or crash the Node.js process due to JavaScript heap out of memory exhaustion. There is no impact on confidentiality or integrity. The disruption affects availability of services or applications using vulnerable SVGO versions.

Official patches are available in SVGO versions 2.8.1, 3.3.3, and 4.0.1 that fix this vulnerability. Users should upgrade to these or later versions to remediate the issue. Red Hat has issued security advisories and errata providing updated packages that incorporate these fixes. Applying these vendor-provided updates is the recommended mitigation. No additional action is required if these versions or later are in use.