[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
colord	2.9.3 → 2.9.4

---

Colord: Slow rejection of oversized malformed color strings

CVE-2026-85062 / GHSA-2wm5-q62r-hmrv

More information

Details

Impact

colord's CSS color string matchers described a number as ([+-]?\d*\.?\d+). In that form \d* and \d+ can match the same digits, so a run of n digits can be divided between them in O(n²) ways, and rejecting an input retries every division. Parsing is synchronous and uninterruptible, so a long malformed color string blocks the thread:

input	time to reject
16 KB	224 ms
64 KB	4.4 s
128 KB	18.5 s

Reachable through colord() and getFormat(), and through any method that accepts a color string — including isEqual(), mix() and contrast(). The affected matchers are parseRgbaString and parseHslaString (built in) and parseHwbaString, parseLchaString, parseCmykaString (plugins).

Growth is polynomial, not exponential — multi-kilobyte payloads are required for a noticeable stall.

Who is affected

Applications that pass attacker-controlled strings of unbounded length to colord() — for example a server validating a color taken from a request body, JSON field, or uploaded stylesheet. colord applies no length limit before matching.

Typical client-side use with short input is not meaningfully affected.

Patches

Fixed in 2.9.4. The number is now written as ([+-]?(?:\d*\.\d+|\d+)), which accepts exactly the same syntax but leaves only one way to match it, making rejection linear — 1 MB of input is rejected in ~5 ms.

Workarounds

Reject or truncate color strings longer than a sane limit (e.g. 100 characters) before passing them to colord.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/omgovich/colord/security/advisories/GHSA-2wm5-q62r-hmrv
• https://nvd.nist.gov/vuln/detail/CVE-2026-85062
• https://github.com/omgovich/colord/pull/141
• https://github.com/omgovich/colord/commit/87018089515ed66a85b1a95c3c7c3fd69a25bac2
• https://github.com/advisories/GHSA-2wm5-q62r-hmrv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

omgovich/colord (colord)

v2.9.4

• Fix: Reject malformed color strings in linear time ❤️ @​GAP-dev

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 38afa1b5-edd0-4a92-b8bd-40b97092fe60

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	colord@​2.9.3 ⏵ 2.9.4	+1	+2	+1

View full report

[pkg-pr-new]

Open in StackBlitz

@poupe/css

npm i https://pkg.pr.new/@poupe/css@532

@poupe/nuxt

npm i https://pkg.pr.new/@poupe/nuxt@532

@poupe/rolldown-vue-css

npm i https://pkg.pr.new/@poupe/rolldown-vue-css@532

@poupe/tailwindcss

npm i https://pkg.pr.new/@poupe/tailwindcss@532

@poupe/theme-builder

npm i https://pkg.pr.new/@poupe/theme-builder@532

@poupe/vue

npm i https://pkg.pr.new/@poupe/vue@532

commit: 2dfd272