CVE-2026-85062 in Colord
Summary
by MITRE • 09/03/2026
Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\d*.?\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in the Colord library prior to version 2.9.4 represents a significant availability risk stemming from algorithmic complexity issues within its color parsing mechanisms. Colord is widely utilized for high-performance color manipulations and conversions, making it a common dependency in web development environments where CSS processing occurs frequently. The core technical flaw resides in the synchronous regular expression matchers used to parse various color string formats, specifically those handling RGB, HSL, HWB, LCH, and CMYK values located in files such as src/colorModels/rgbString.ts and their counterparts for other color models. These parsers utilize a numeric regex pattern defined as ([+-]?\d*.?\d+), which is designed to match signed decimal numbers. However, the structure of this regular expression contains overlapping quantifiers that allow for ambiguous parsing paths when processing malformed or specifically crafted input strings.
When an attacker supplies unbounded color string data to functions such as colord(), getFormat(), isEqual(), mix(), or contrast(), they can exploit these ambiguities in the regex engine's backtracking behavior. The issue arises because the same sequence of digits can be divided between overlapping quantifiers in quadratically many ways during the rejection phase if the input does not fully conform to expected formats. This phenomenon, often referred to as ReDoS or Regular Expression Denial of Service, causes the processing thread to block while it exhaustively explores these invalid parsing combinations. The impact is particularly severe because Colord operates synchronously; therefore, a single malicious request can freeze the entire event loop in Node.js environments or block UI rendering threads in browser contexts, effectively causing a denial of service for any application relying on this library for color processing tasks.
The operational impact extends beyond simple performance degradation to complete system unavailability if the vulnerability is triggered repeatedly or with large payloads. An attacker capable of injecting malicious data through request bodies, JSON fields, or uploaded stylesheets can trigger these multi-kilobyte payload scenarios that block processing indefinitely. This affects critical functions including parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. In a production environment where color data is processed dynamically from user inputs or external sources, this vulnerability allows for efficient resource exhaustion attacks without requiring authentication in many cases, depending on how the library is integrated into the application's input validation pipeline.
From a classification perspective, this vulnerability aligns with CWE-400, which covers Uncontrolled Resource Consumption, and more specifically CWE-1333, Inefficient Regular Expression Complexity. It also maps to MITRE ATT&CK technique T1496, Resource Hijacking, where an attacker uses computing resources such as CPU or memory for their own purposes rather than the intended purpose of the system. The synchronous nature of the flaw means that it does not require complex exploitation chains; a single well-crafted string is sufficient to cause significant disruption, highlighting the importance of input sanitization and validation before passing data to parsing libraries.
To mitigate this vulnerability, organizations must immediately upgrade Colord to version 2.9.4 or later, where these regular expression ambiguities have been resolved by optimizing the matching logic to prevent exponential backtracking. For applications that cannot update immediately due to dependency constraints, implementing strict input validation is essential. This includes enforcing maximum length limits on color string inputs and rejecting any strings containing excessive numbers of digits or malformed numeric patterns before they reach the Colord parsing functions. Additionally, integrating these libraries within asynchronous wrappers or worker threads can help isolate potential blocking operations from the main application thread, thereby preserving overall system availability even if a malicious payload is processed. Regular security audits of third-party dependencies and monitoring for unusual CPU spikes associated with color processing modules are recommended practices to detect such issues early in the development lifecycle.