Colord
Monthly
Synchronous CSS color string parsing in colord (npm, versions prior to 2.9.4) exposes Node.js applications to event-loop denial of service through catastrophic regex backtracking (ReDoS). The ambiguous numeric pattern `([+-]?\d*\.?\d+)` used across five color-model parsers - RGB, HSL, HWB, LCH, and CMYK - allows overlapping quantifiers to partition the same digit sequence in O(n²) ways during rejection, blocking the JavaScript thread for seconds per malformed payload. An unauthenticated attacker who can supply an unbounded color string to any exposed application endpoint that calls `colord()`, `getFormat()`, `isEqual()`, `mix()`, or `contrast()` can render the service unresponsive; no public exploit code has been identified at time of analysis.
Synchronous CSS color string parsing in colord (npm, versions prior to 2.9.4) exposes Node.js applications to event-loop denial of service through catastrophic regex backtracking (ReDoS). The ambiguous numeric pattern `([+-]?\d*\.?\d+)` used across five color-model parsers - RGB, HSL, HWB, LCH, and CMYK - allows overlapping quantifiers to partition the same digit sequence in O(n²) ways during rejection, blocking the JavaScript thread for seconds per malformed payload. An unauthenticated attacker who can supply an unbounded color string to any exposed application endpoint that calls `colord()`, `getFormat()`, `isEqual()`, `mix()`, or `contrast()` can render the service unresponsive; no public exploit code has been identified at time of analysis.