CVE-2021-23567 json
Denial of Service (DoS)
published 2022-01-14 4 y ago modified 2026-06-17 4 mo ago also GHSA-gh88-3pxp-6fm8 , EUVD-2022-0604
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.8%
- EPSS 1.8% chance of exploitation in 30 days, percentile 78%
- public exploits
- 0
- none known
Summary
The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers' controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i < Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0
Patch / fix
Exploit prediction
1.79% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- snyk.io https://snyk.io/vuln/SNYK-JS-COLORS-2331906 referenced PoC, tagged "exploit" by a source, unverified
- github.com https://github.com/Marak/colors.js/issues/285 referenced PoC, tagged "exploit" by a source, unverified
- github.com https://github.com/Marak/colors.js/issues/285%23issuecomment-1008212640 referenced PoC, tagged "exploit" by a source, unverified
- snyk.io https://snyk.io/blog/open-source-maintainer-pulls-the-plug-on-npm-packages-colors-and-faker-now-what/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | colors | >=1.4.1 |
no fix listed |
Affected products
- n/a colors
Classification
- Weakness
-
- CWE-835 Loop with Unreachable Exit Condition
References
-
github.com
/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6%23diff-92bbac9a308cd5fcf9db165841f2d90ce981ba
web, patch, third-party-advisory
-
snyk.io
/vuln/SNYK-JS-COLORS-2331906
web, exploit, third-party-advisory
-
github.com
/Marak/colors.js/issues/285
web, exploit, issue-tracking, third-party-advisory
-
github.com
/Marak/colors.js/issues/285%23issuecomment-1008212640
web, exploit, issue-tracking, third-party-advisory
-
snyk.io
/blog/open-source-maintainer-pulls-the-plug-on-npm-packages-colors-and-faker-now-what/
exploit, mitigation, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-23567
advisory
-
github.com
/Marak/colors.js
package
-
snyk.io
/blog/open-source-maintainer-pulls-the-plug-on-npm-packages-colors-and-faker-now-what
web
Sources
- CVE List CVE-2021-23567
- GitHub Advisory GHSA-gh88-3pxp-6fm8
- NVD CVE-2021-23567
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.