CVE-2021-29060
Regular Expression Denial of Service (ReDOS)
Impact
In the npm package `color-string`, there is a ReDos (Regular Expression Denial of Service) vulnerability regarding an exponential time complexity for linearly increasing input lengths for `hwb()` color strings. Strings reaching more than 5000 characters would see several milliseconds of processing time; strings reaching more than 50,000 characters began seeing 1500ms (1.5s) of processing time. The cause was due to a the regular expression that parses hwb() strings - specifically, the hue value - where the integer portion of the hue value used a 0-or-more quantifier shortly thereafter followed by a 1-or-more quantifier. This caused excessive backtracking and a cartesian scan, resulting in exponential time complexity given a linear increase in input length.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | color-string | < 1.5.5 | 1.5.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Color-String Project | Color-String | before 1.5.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/Qix-/color-string/commit/0789e21284c33d89ebc4ab4ca6f759b9375ac9d3
- https://github.com/yetingli/PoCs/blob/main/CVE-2021-29060/Color-String.md
- https://github.com/yetingli/SaveResults/blob/main/js/color-string.js
- https://www.npmjs.com/package/color-string
- https://github.com/advisories/GHSA-257v-vj4p-3w2h
- https://nvd.nist.gov/vuln/detail/CVE-2021-29060
- https://github.com/Qix-/color-string/releases/tag/1.5.5