Vulnerability · Published Sep 3, 2026 · Assigned by GitHub_M
CVE-2026-85062Colord: Slow rejection of oversized malformed color strings
Medium 6.9
In plain English
A medium-severity regular-expression denial of service in colord from omgovich. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\d*.?\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | colord | 2.9.4 | GHSA-2wm5-q62r-hmrv |
Affected products (as reported)
Weakness: CWE-1333 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/omgovich/colord/security/advisories/GHSA-2wm5-q62r-hmrv x_refsource_CONFIRM
- https://github.com/omgovich/colord/pull/141 x_refsource_MISC
- https://github.com/omgovich/colord/commit/87018089515ed66a85b1a95c3c7c3fd69a25bac2 x_refsource_MISC