d3-color vulnerable to ReDoS

published 2022-09-29 4y ago modified 2026-09-10 2mo ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.

Patch / fix

fixed in 1 links 2

npm d3-color 3.1.0

github.com/d3/d3-color#100 pull request
github.com/d3/d3-color/releases/tag/v3.1.0 release

Is GHSA-36jr-mh4h-2g58 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
npm	d3-color	>=1.0.2, <3.1.0	3.1.0

Classification

Weakness

CWE-1333 Inefficient Regular Expression Complexity
CWE-400 Uncontrolled Resource Consumption

References

github.com /d3/d3-color/pull/100
web
github.com /d3/d3-color
package
github.com /d3/d3-color/releases/tag/v3.1.0
web
security.snyk.io /vuln/SNYK-JS-D3COLOR-1076592
web

Sources

GitHub Advisory GHSA-36jr-mh4h-2g58

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.