GHSA-36jr-mh4h-2g58
d3-color vulnerable to ReDoS
GHSA-36jr-mh4h-2g58 is a vulnerability with no CVSS score yet in d3-color, published September 29, 2022. No source lists public exploit code. Fixed in d3-color 3.1.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.1.0d3-color +3 more
Description
The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
d3-colornpm | 1.0.2 up to 3.1.0 | 3.1.0 |
d3-colorTuxCare:npm | 1.4.1-tuxcare.0 up to 1.4.1-tuxcare.1, plus listed versions 1.4.1 | 1.4.1-tuxcare.1 |
d3-colorRoot:npm | before 2.0.0-aikido.1 | 2.0.0-aikido.1 |
@rootio/d3-colorRoot:npm | before 2.0.0-root.io.1 | 2.0.0-root.io.1 |
What each source reports
GitHub AdvisoriesNo score
d3-color vulnerable to ReDoS
The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.
- Record
GHSA-36jr-mh4h-2g58- Weakness
- CWE-400, CWE-1333
- Updated
- 2026-11-02
OSVCLSA-2026-1772496676No score
TuxCare security update for d3-color (1 CVE)
TuxCare rebuilt d3-color to address 1 CVE. Fixed in 1.4.1-tuxcare.1.
- Record
CLSA-2026-1772496676- Updated
- 2026-11-02
OSVNo score
d3-color vulnerable to ReDoS
The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.
- Record
GHSA-36jr-mh4h-2g58- Weakness
- CWE-1333, CWE-400
- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-36jr-mh4h-2g58No score
GHSA-36jr-mh4h-2g58 in d3-color - Patched by Root
Root has patched GHSA-36jr-mh4h-2g58 in the d3-color package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-36jr-mh4h-2g58- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.