SVG files arrive in Cloudflare Images

Cloudflare Images has, since its launch a year ago, handled the common raster formats — JPG, WebP, PNG and GIF. SVG was deliberately left out. Vector files need no server-side resizing, and treating them as images seemed both unnecessary and risky, given the long history of SVG-based attacks. But customers kept asking, and with roughly half of all websites now serving SVG files, the request became hard to ignore. Starting today, Cloudflare Images can store and serve SVG files safely.

Why SVG matters

SVG represents images as geometric shapes rather than pixels, which makes it ideal for illustrations, charts, logos, and icons. A vector image scales to any resolution with perfect sharpness, while a raster image degrades. The difference becomes obvious at small sizes: a 100px-wide PNG upscaled to 300px shows clear quality loss, while the same-width SVG scales cleanly. Because the SVG file itself is just a set of drawing instructions, resizing happens client-side with an HTML width attribute — no server-side transformation needed.

The file-size advantage is significant too. A complex SVG file used in the Cloudflare example weighs 142 KB and renders at any size. Generating a 1024px PNG of the same subject produces a 344 KB file — more than twice as heavy for a single fixed resolution. Serving the SVG version saves storage and bandwidth, while viewbox attributes provide panning, zooming, cropping, and scaling without additional file versions.

The security problem with SVG

SVG files are not just images. They are XML documents as capable as HTML pages, able to contain JavaScript, fetch external URLs, or embed HTML elements. That flexibility has spawned decades of exploits — from the old Billion Laughs attack, which abused XML entity recursion to exhaust parser resources, to modern threats built around cross-site scripting (XSS) and references to foreign objects. Serving an untrusted SVG inside an <img> tag can expose end-users to any malicious payload the file carries.

Filtering SVG down to an image

Cloudflare built an open-source Rust filter, svg-hush, that strips SVG files down to image-safe features, making them as safe to serve as JPEG or PNG:

  • Scripting is removed, blocking cross-site scripting attacks — including the case where the SVG is opened directly as a top-level document.
  • Hyperlinks to other documents are stripped, reducing SEO spam and phishing potential.
  • References to cross-origin resources are cut, preventing third-party tracking of viewers.

Embedded raster images in formats like JPEG and PNG, included as Data URLs, pass through and get optimized like any other Cloudflare-processed image. Recursively embedded SVG files, however, are not supported — the risk of parser resource exhaustion from recursive nesting is too great.

The filter runs in streaming fashion without buffering, making it fast enough for on-the-fly processing. Content-Security-Policy headers are also set on responses as a first line of defense, but the filtering protects even if those headers are lost — for instance, when a file gets saved locally and served from elsewhere. The open-source repository includes tests showing sample XML before and after filtering, with external references, foreignObjects, and other threats removed.

Working with SVG in the pipeline

SVG uploads work exactly like any other format, whether via the dashboard UI or API. Variants — named or flexible — exist to transform bitmap images, but vector files need no pipeline resizing. The UI shows a banner explaining this, and every variant preview displays the same image at the same dimensions.

The default public variant works immediately for serving SVG files:

https://imagedelivery.net/<your_account_hash>/<your_SVG_ID>/public

Any named variant works equally well, since the output is unaffected by the variant used. Cloudflare Image Resizing customers can also serve SVG files; details are in the Developer Documentation.

Getting started

SVG support is live now in Cloudflare Images. Developers interested in expanding the filtering capabilities can contribute to the SVG-Hush repository or connect with the team on the Cloudflare Developers Discord Server.