Regular Expression Denial of Service in dat.gui

Description

All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.7.7

References

• GHSA-chwr-hf3w-c984
• snyk.io
• www.npmjs.com
• CVE-2020-7755
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• min-document vulnerable to prototype pollution - CVE-2025-57352
• Vite bypasses server.fs.deny when using ?raw?? - CVE-2025-30208
• GetmeUK ContentTools Cross-Site Scripting (XSS) - CVE-2025-2699
• node-gettext vulnerable to Prototype Pollution - CVE-2024-21528

Tags:

npm

dat.gui