What is GHSA-36jr-mh4h-2g58?

GHSA-36jr-mh4h-2g58 is a security advisory published by GitHub Security Advisories with High severity. d3-color vulnerable to ReDoS

Why does GHSA-36jr-mh4h-2g58 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-36jr-mh4h-2g58?

GHSA-36jr-mh4h-2g58 affects 1 product, including: npm/d3-color:\u003e= 1.0.2, \u003c 3.1.0.

GHSA-36jr-mh4h-2g58HighDisclosed before NVD

d3-color vulnerable to ReDoS

Vendor

GitHub Security Advisories

Published

September 29, 2022

Last Modified

July 30, 2026

📋 Description

The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.

🎯 Affected products1

npm/d3-color:>= 1.0.2, < 3.1.0

🔗 References (4)

https://github.com/d3/d3-color/pull/100
https://github.com/d3/d3-color/releases/tag/v3.1.0
https://security.snyk.io/vuln/SNYK-JS-D3COLOR-1076592
https://github.com/advisories/GHSA-36jr-mh4h-2g58