Denial of Service in rgb2hex

Description

All versions of rgb2hex are vulnerable to Regular Expression Denial of Service (ReDoS) when an attacker can pass in a specially crafted invalid color value.

Recommendation

Update the rgb2hex package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.1.6
• Patched version(s): 0.1.6

References

• GHSA-65p8-3hm4-h9h8
• hackerone.com
• www.npmjs.com
• snyk.io
• CWE-400

Related Issues

• Denial of Service in mem - Vulnerability
• Axios: Excessive recursion in formDataToJSON can cause denial of service - Vulnerability
• mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: - Vulnerability
• Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

rgb2hex