AIKIDO-2026-86953

TL;DR

The SVG header parser scans input with a searching regular expression that is not anchored, so input containing many < characters but no > restarts the scan at each position and runs in quadratic time. The synchronous path applies no size cap and the streaming path re-scans the whole accumulated buffer on every chunk, so a crafted image pins the Node.js event loop at full CPU. Every entry point that reaches the SVG parser is exposed, including remote URL fetches where the input is supplied via a link. The fix anchors the header regular expression with deterministic parsing and limits inspected SVG header data to the first 10 KiB in both the sync and stream paths.