{"id":"GHSA-36jr-mh4h-2g58","aliases":["CLSA-2026-1772496676","ROOT-APP-NPM-GHSA-36jr-mh4h-2g58"],"status":"published","title":"d3-color vulnerable to ReDoS","description":"The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-400"],"published":"2022-09-29T14:12:55Z","modified":"2026-10-15T09:47:46Z","fixes":[{"ecosystem":"npm","package":"d3-color","fixed_in":["3.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"d3-color","fixed_in":["1.4.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"d3-color","fixed_in":["2.0.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/d3-color","fixed_in":["2.0.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"d3-color","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.2"},{"fixed":"3.1.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"d3-color","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.1-tuxcare.0"},{"fixed":"1.4.1-tuxcare.1"}]}],"versions":["1.4.1"]},{"source":"osv","ecosystem":"npm","package":"d3-color","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.2"},{"fixed":"3.1.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"d3-color","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/d3-color","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-root.io.1"}]}]}],"references":[{"url":"https://github.com/d3/d3-color/pull/100","tags":["web"]},{"url":"https://github.com/d3/d3-color/releases/tag/v3.1.0","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-D3COLOR-1076592","tags":["web"]},{"url":"https://github.com/advisories/GHSA-36jr-mh4h-2g58"},{"url":"https://github.com/d3/d3-color","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-36jr-mh4h-2g58","title":"d3-color vulnerable to ReDoS","description":"The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.","status":"published","published":"2022-09-29T14:12:55Z","modified":"2026-07-30T20:37:28Z","cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:40:54.767849Z"}],"osv":[{"id":"CLSA-2026-1772496676","title":"TuxCare security update for d3-color (1 CVE)","description":"TuxCare rebuilt d3-color to address 1 CVE. Fixed in 1.4.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:08Z","modified":"2026-10-15T09:47:46.437117358Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"GHSA-36jr-mh4h-2g58","title":"d3-color vulnerable to ReDoS","description":"The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.","status":"published","published":"2022-09-29T14:12:55Z","modified":"2026-09-10T03:49:55.734654222Z","cwes":["CWE-1333","CWE-400"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"ROOT-APP-NPM-GHSA-36jr-mh4h-2g58","title":"GHSA-36jr-mh4h-2g58 in d3-color - Patched by Root","description":"Root has patched GHSA-36jr-mh4h-2g58 in the d3-color package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-29T16:46:26Z","modified":"2026-09-29T17:15:03.632725917Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}