{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"1.4.1"}],"component":"colors","cve_ids":["CVE-2021-23567"],"ecosystem":"npm","epss":0.01733,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-gh88-3pxp-6fm8","id":"tcs_01M5KFRRMX16N44W5FDA2F061D","modified_at":"2026-03-13T21:56:25.303006Z","published_at":"2022-01-21T23:39:50Z","references":["https://osv.dev/vulnerability/GHSA-gh88-3pxp-6fm8","https://nvd.nist.gov/vuln/detail/CVE-2021-23567","https://github.com/Marak/colors.js/issues/285","https://github.com/Marak/colors.js/issues/285%23issuecomment-1008212640","https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6%23diff-92bbac9a308cd5fcf9db165841f2d90ce981baddcb2b1e26cfff170929af3bd1R18","https://github.com/Marak/colors.js","https://snyk.io/blog/open-source-maintainer-pulls-the-plug-on-npm-packages-colors-and-faker-now-what","https://snyk.io/vuln/SNYK-JS-COLORS-2331906"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-gh88-3pxp-6fm8","url":"https://osv.dev/vulnerability/GHSA-gh88-3pxp-6fm8"}],"summary":"Infinite Loop in colors.js"}