Medium, CVSS 6.9npmAmendedPublished
Colord: Slow rejection of oversized malformed color strings
CVE-2026-85062 · GHSA-2wm5-q62r-hmrv
- Affected
- npm colord < 2.9.4
- Fixed in
- 2.9.4· Vendor fix available
- Issue
- Impact colord's CSS color string matchers described a number as ([+-]?\d\.?\d+). In that form \d and \d+ can match the same digits, so a run of n digits can be divided between them in O(n²) ways, and rejecting an input retries every division. Parsing is synchronous and uninterruptible, so a long malformed color string blocks the thread: | input | time to reject | | --- | --- | | 16 KB | 224 ms | | 64 KB | 4.4 s | | 128 KB | 18.5 s | Reachable through colord() and getFormat(), and through any method that accepts a color string — including isEqual(), mix() and contrast(). The affected matchers are parseRgbaString and parseHslaString (built in) and parseHwbaString, parseLchaString, parseCmykaString (plugins). Growth is polynomial, not exponential — multi-kilobyte payloads are required for a noticeable stall. Who is affected Applications that pass attacker-controlled strings of unbounded length to colord() — for example a server validating a color taken from a request body, JSON field,…
Recommended action: Upgrade to 2.9.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.