Executive brief
colors.js is a popular Node.js library for formatting terminal output with colors. Versions after 1.4.0 contain an intentional infinite loop in the americanFlag module that causes the application to hang indefinitely, making the library unusable and causing service outages in any application that imports it. This appears to be deliberate sabotage by the maintainer to make the package unusable.
Technical details
The vulnerability is an infinite loop (CWE-835) introduced in the americanFlag module with a for loop iterating from 666 to Infinity: `for (let i = 666; i < Infinity; i++;)`. This causes immediate denial of service when the module is loaded or when its functionality is invoked. The attack requires only that an application import and use the affected versions (1.4.1 and later), with no special authentication, network access requirements, or user interaction needed. Any application using colors.js versions after 1.4.0 will hang and become unresponsive. Mitigation involves pinning the dependency to version 1.4.0 or earlier.
Affected products
- Marak colors.js 1.4.1 and later
Timeline
- 2022-01-08: disclosed: Zalgo issue with v1.4.44-liberty-2 release publicly reported
- 2022-01-21: advisory: GHSA-gh88-3pxp-6fm8 published
- 2022-01-14: other: CVE-2021-23567 published on NVD