Dicebear vulnerabilities
We track 2 vulnerabilities in Dicebear products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on March 24, 2026.
2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score
Latest Dicebear vulnerabilities
- 7.5 High severity
dicebear: Incorrect Regular Expression
DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the `ensureSize()` function in `@dicebear/converter` used a regex-based approach to rewrite SVG `width`/`height` attributes, capping them at 2048px to prevent denial of service
- 7.5 High severity
dicebear: Allocation of Resources Without Limits or Throttling
DiceBear is an avatar library for designers and developers. Prior to version 9.4.0, the `ensureSize()` function in `@dicebear/converter` read the `width` and `height` attributes from the input SVG to determine the output canvas size for rasterization (PNG, JPE