GitHub Advisoryadvisory · npm

GHSA-65p8-3hm4-h9h8 Denial of Service in rgb2hex

MEDIUM Published 2019-08-23 Modified 2021-08-17 Official page ↗
Ecosystem
npm
Packages
rgb2hex
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2019-08-22

Affected packages

• npm rgb2hex: < 0.1.6 → fixed in 0.1.6

Description

All versions of `rgb2hex` are vulnerable to Regular Expression Denial of Service (ReDoS) when an attacker can pass in a specially crafted invalid color value. Recommendation Update to version 0.1.6 or later.

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References