Infinite loop causing Denial of Service in colors
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- —
- Fix status
- No fix listed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-835.
Summary
colors is a library for including colored text in node.js consoles. Between 07 and 09 January 2022, colors versions 1.4.1, 1.4.2, and 1.4.44-liberty-2 were published including malicious code that caused a Denial of Service due to an infinite loop. Software dependent on these versions experienced the printing of randomized characters to console and an infinite loop resulting in unbound system resource consumption. Users of colors relying on these specific versions should downgrade to version 1.4.0.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | colors (npm) | 1.4.1 – 1.4.2 | — | No fix listed | GHSA-5rqg-jm4f-cqx7 |
| — | colors (npm) | — | — | No fix listed | GHSA-5rqg-jm4f-cqx7 |
- colors (npm) Vendor— Affected 1.4.1 – 1.4.2 Fixed in — No fix listed GHSA-5rqg-jm4f-cqx7
- colors (npm) Vendor— Affected — Fixed in — No fix listed GHSA-5rqg-jm4f-cqx7
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-03 Threatist record created from GHSA-5rqg-jm4f-cqx7
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences