{"id":"GHSA-36jr-mh4h-2g58","summary":"d3-color vulnerable to ReDoS","details":"The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.","modified":"2026-08-14T05:15:08.632624327Z","published":"2022-09-29T14:12:55Z","database_specific":{"github_reviewed_at":"2022-09-29T14:12:55Z","nvd_published_at":null,"cwe_ids":["CWE-1333","CWE-400"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/d3/d3-color/pull/100"},{"type":"PACKAGE","url":"https://github.com/d3/d3-color"},{"type":"WEB","url":"https://github.com/d3/d3-color/releases/tag/v3.1.0"},{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-JS-D3COLOR-1076592"}],"affected":[{"package":{"name":"d3-color","ecosystem":"npm","purl":"pkg:npm/d3-color"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.2"},{"fixed":"3.1.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-36jr-mh4h-2g58/GHSA-36jr-mh4h-2g58.json"}}],"schema_version":"1.9.0"}