Denial of service in three

Description

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors.

PoC:

Recommendation

Update the three package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.125.0
• Patched version(s): 0.125.0

References

• GHSA-fq6p-x6j3-cmmq
• snyk.io
• CVE-2020-28496
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype pollution in 101 - CVE-2021-25943
• Use-After-Free in puppeteer - CVE-2019-5786
• Open Redirect in node-forge - CVE-2022-0122
• Prototype Pollution in sey - CVE-2021-23663

Tags:

npm

three