GHSA-36jr-mh4h-2g58

Source

https://github.com/advisories/GHSA-36jr-mh4h-2g58

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-36jr-mh4h-2g58/GHSA-36jr-mh4h-2g58.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-36jr-mh4h-2g58

Downstream

CGA (58)

CLSA (1)

CLSA-2026-1772496676

MINI (2)

Published

2022-09-29T14:12:55Z

Modified

2026-08-14T05:15:08Z

Summary

d3-color vulnerable to ReDoS

Details

The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.

Database specific

{
    "cwe_ids": [
        "CWE-1333",
        "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-29T14:12:55Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

npm / d3-color

Package

Name: d3-color; View open source insights on deps.dev
Purl: pkg:npm/d3-color

Affected ranges

Type: SEMVER
Events: Introduced

1.0.2

Fixed

3.1.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-36jr-mh4h-2g58/GHSA-36jr-mh4h-2g58.json"