Svg sanitize: svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences (CVE-2026-107381)

The vulnerability (CVE-2026-107381) in enshrined/svg-sanitize occurs because the Resolver::processReferences() function uses a case-sensitive XPath query to collect <use> elements with 'href' or 'xlink:href' attributes. If an attacker uses a mixed-case attribute such as 'xlink:HrEf', these elements are not added to the reference graph and thus not removed by the nesting-DoS mitigation. Later in the sanitization process, the attribute names are normalized back to lowercase, resulting in a fully live nesting bomb that the sanitizer intended to neutralize. This flaw is a mirror of a previous issue (CVE-2025-55166) but affects the attribute name matching rather than the attribute value. The vulnerability affects versions prior to 1.0.0 of the library. Proof-of-concept tests demonstrate that the sanitizer fails to remove nested <use> elements when mixed-case attributes are used, enabling a denial-of-service condition.

An attacker with the ability to upload or submit SVG files to an application using the vulnerable version of enshrined/svg-sanitize can bypass the nesting limit protection and cause a denial-of-service by submitting SVGs with mixed-case 'xlink:HrEf' attributes. This leads to resource exhaustion or application instability due to the processing of deeply nested <use> elements that should have been removed. No privileges beyond the ability to submit SVG content are required. There is no impact on confidentiality or integrity, only availability.

A patch is available for this vulnerability. The recommended fix is to make the attribute name matching case-insensitive when building the reference graph or to reorder the sanitization steps so that attribute names are normalized before the reference graph is constructed. Users should update to a patched version of enshrined/svg-sanitize that addresses this issue. Until patched, applications should consider rejecting SVG inputs with mixed-case 'xlink:href' attributes or apply additional sanitization to normalize attribute names prior to processing.