VulnerabilityPublished 29 Sep 2022Updated 30 Jul 2026

d3-color vulnerable to ReDoS

Affects d3-colorSource GCVE Database

Severity

High

Rated by Threat Radar

Patch: Available – fixed in 3.1.0

Data as of 30 Jul 2026, 23:56 UTC

What to do

Upgrade d3-color to 3.1.0.

Affected software

Product	Affected	Fixed in
npmd3-color	Affected >=1.0.2 <3.1.0	Fixed in 3.1.0

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Upgrade d3-color to version 3.1.0 or later, where the vulnerability has been patched.

Description

The d3-color module, used for color space representations in browsers, has a vulnerability in versions from 1.0.2 up to but not including 3.1.0. This vulnerability is a Regular Expression Denial of Service (ReDoS) issue. The vulnerability has been fixed in version 3.1.0.

Impact

Exploitation of this vulnerability can lead to denial of service conditions by causing the application to consume excessive CPU resources when processing crafted input that triggers the vulnerable regular expression. This can degrade application availability or responsiveness. There are no reports of known exploits in the wild.

Summary

Versions of the d3-color module prior to 3.1.0 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack. This vulnerability arises from inefficient regular expression processing that can be exploited to cause excessive resource consumption, leading to denial of service. The issue is tracked under GHSA-36jr-mh4h-2g58 and is associated with CWE-400 (Uncontrolled Resource Consumption) and CWE-1333. The vulnerability has been patched in version 3.1.0 of d3-color.

CWE-400Uncontrolled Resource Consumption (opens in a new tab)
Class weaknessLikelihood of exploit: High
The product does not properly control the allocation and maintenance of a limited resource.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place.
Architecture and Design
Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or; uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Architecture and Design
Ensure that protocols have specific limits of scale placed on them.
OWASP Cheat Sheets
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V12.1.1 (opens in a new tab)
Attack patterns
XML Ping of the Death (opens in a new tab)
Regular Expression Exponential Blowup (opens in a new tab)
Sustained Client Engagement (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1333Inefficient Regular Expression Complexity (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
OWASP Cheat Sheets
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V12.1.1 (opens in a new tab)
Attack patterns
Regular Expression Exponential Blowup (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Jul 2026, 23:56 UTC

WeaknessesCWE-400, CWE-1333

Technical details

References

Community reviews

Related threats