Executive brief
Colord is a popular JavaScript library used to parse and validate CSS color strings. A flaw in its regular expression pattern causes color string parsing to take exponentially longer as input grows, allowing attackers to freeze an application thread by submitting oversized malformed color strings. This affects servers that validate user-supplied colors without length limits, such as in REST APIs or uploaded stylesheets.
Technical details
The vulnerability is a ReDoS (Regular Expression Denial of Service) in colord's CSS color parsing, specifically in the regex pattern ([+-]?\d*\.?\d+) used to match decimal numbers. The pattern allows the overlapping quantifiers \d* and \d+ to match the same digits, creating O(n²) ways to divide a run of n digits during backtracking. When the parser rejects an input, it retries every division, causing exponential behavior. The vulnerable matchers are parseRgbaString, parseHslaString (built-in) and parseHwbaString, parseLchaString, parseCmykaString (plugins). Parsing is synchronous and uninterruptible, so a long malformed color string blocks the event loop. The fix changes the regex to ([+-]?(?:\d*\.\d+|\d+)), which preserves semantics but leaves only one way to match, eliminating backtracking. No authentication is required; the vulnerability is reachable through public APIs that accept color strings. The practical impact is thread stall (denial of service) rather than data compromise.
Affected products
- omgovich colord < 2.9.4
Timeline
- 2026-09-08: disclosed: Published to GitHub Advisory Database
- 2026-09-04: patched: Fixed in version 2.9.4
- 2026-09-03: advisory: Published to National Vulnerability Database