GitHub Advisoryadvisory · npm

GHSA-36jr-mh4h-2g58 d3-color vulnerable to ReDoS

HIGH Published 2022-09-29 Modified 2026-07-30 Official page ↗
Ecosystem
npm
Packages
d3-color
Severity
High
Weaknesses
CWE-1333, CWE-400
Reviewed
2022-09-29

Affected packages

• npm d3-color: >= 1.0.2, < 3.1.0 → fixed in 3.1.0

Description

The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.

Related

Weakness · CWE (2)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References