{"id":"GHSA-2wm5-q62r-hmrv","summary":"Colord: Slow rejection of oversized malformed color strings","details":"### Impact\n\n`colord`'s CSS color string matchers described a number as `([+-]?\\d*\\.?\\d+)`. In that form `\\d*` and `\\d+` can match the same digits, so a run of *n* digits can be divided between them in O(n²) ways, and rejecting an input retries every division. Parsing is synchronous and uninterruptible, so a long malformed color string blocks the thread:\n\n| input | time to reject |\n| --- | --- |\n| 16 KB | 224 ms |\n| 64 KB | 4.4 s |\n| 128 KB | 18.5 s |\n\nReachable through `colord()` and `getFormat()`, and through any method that accepts a color string — including `isEqual()`, `mix()` and `contrast()`. The affected matchers are `parseRgbaString` and `parseHslaString` (built in) and `parseHwbaString`, `parseLchaString`, `parseCmykaString` (plugins).\n\nGrowth is polynomial, not exponential — multi-kilobyte payloads are required for a noticeable stall.\n\n### Who is affected\n\nApplications that pass attacker-controlled strings of unbounded length to `colord()` — for example a server validating a color taken from a request body, JSON field, or uploaded stylesheet. `colord` applies no length limit before matching.\n\nTypical client-side use with short input is not meaningfully affected.\n\n### Patches\n\nFixed in **2.9.4**. The number is now written as `([+-]?(?:\\d*\\.\\d+|\\d+))`, which accepts exactly the same syntax but leaves only one way to match it, making rejection linear — 1 MB of input is rejected in ~5 ms.\n\n### Workarounds\n\nReject or truncate color strings longer than a sane limit (e.g. 100 characters) before passing them to `colord`.","aliases":["CVE-2026-85062"],"modified":"2026-09-08T21:00:06.239800217Z","published":"2026-09-08T20:51:57Z","database_specific":{"cwe_ids":["CWE-1333"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-09-08T20:51:57Z","nvd_published_at":"2026-09-03T21:17:23Z"},"references":[{"type":"WEB","url":"https://github.com/omgovich/colord/security/advisories/GHSA-2wm5-q62r-hmrv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85062"},{"type":"WEB","url":"https://github.com/omgovich/colord/pull/141"},{"type":"WEB","url":"https://github.com/omgovich/colord/commit/87018089515ed66a85b1a95c3c7c3fd69a25bac2"},{"type":"PACKAGE","url":"https://github.com/omgovich/colord"}],"affected":[{"package":{"name":"colord","ecosystem":"npm","purl":"pkg:npm/colord"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.9.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2wm5-q62r-hmrv/GHSA-2wm5-q62r-hmrv.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}