GHSA-2wm5-q62r-hmrv

Suggest an improvement
Source
https://github.com/advisories/GHSA-2wm5-q62r-hmrv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2wm5-q62r-hmrv/GHSA-2wm5-q62r-hmrv.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2wm5-q62r-hmrv
Aliases
Downstream
CGA (61)
MINI (2)
Published
2026-09-08T20:51:57Z
Modified
2026-09-08T21:00:06Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Colord: Slow rejection of oversized malformed color strings
Details

Impact

colord's CSS color string matchers described a number as ([+-]?\d*\.?\d+). In that form \d* and \d+ can match the same digits, so a run of n digits can be divided between them in O(n²) ways, and rejecting an input retries every division. Parsing is synchronous and uninterruptible, so a long malformed color string blocks the thread:

input time to reject
16 KB 224 ms
64 KB 4.4 s
128 KB 18.5 s

Reachable through colord() and getFormat(), and through any method that accepts a color string — including isEqual(), mix() and contrast(). The affected matchers are parseRgbaString and parseHslaString (built in) and parseHwbaString, parseLchaString, parseCmykaString (plugins).

Growth is polynomial, not exponential — multi-kilobyte payloads are required for a noticeable stall.

Who is affected

Applications that pass attacker-controlled strings of unbounded length to colord() — for example a server validating a color taken from a request body, JSON field, or uploaded stylesheet. colord applies no length limit before matching.

Typical client-side use with short input is not meaningfully affected.

Patches

Fixed in 2.9.4. The number is now written as ([+-]?(?:\d*\.\d+|\d+)), which accepts exactly the same syntax but leaves only one way to match it, making rejection linear — 1 MB of input is rejected in ~5 ms.

Workarounds

Reject or truncate color strings longer than a sane limit (e.g. 100 characters) before passing them to colord.

Database specific 
{
    "cwe_ids":  [
        "CWE-1333"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-08T20:51:57Z",
    "nvd_published_at":  "2026-09-03T21:17:23Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / colord

Package

Name
colord
View open source insights on deps.dev
Purl
pkg:npm/colord

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.9.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2wm5-q62r-hmrv/GHSA-2wm5-q62r-hmrv.json"