CVE-2021-23567

The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers' controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i < Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0

• CWE-835

• https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6%23diff-92bbac9a308cd5fcf9db165841f2d90ce981baddcb2b1e26cfff170929af3bd1R18Patch, Third Party Advisory
• https://github.com/Marak/colors.js/issues/285Exploit, Issue Tracking, Third Party Advisory
• https://github.com/Marak/colors.js/issues/285%23issuecomment-1008212640Exploit, Issue Tracking, Third Party Advisory
• https://snyk.io/blog/open-source-maintainer-pulls-the-plug-on-npm-packages-colors-and-faker-now-what/Exploit, Mitigation, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-COLORS-2331906Exploit, Third Party Advisory
• https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6%23diff-92bbac9a308cd5fcf9db165841f2d90ce981baddcb2b1e26cfff170929af3bd1R18Patch, Third Party Advisory
• https://github.com/Marak/colors.js/issues/285Exploit, Issue Tracking, Third Party Advisory
• https://github.com/Marak/colors.js/issues/285%23issuecomment-1008212640Exploit, Issue Tracking, Third Party Advisory
• https://snyk.io/blog/open-source-maintainer-pulls-the-plug-on-npm-packages-colors-and-faker-now-what/Exploit, Mitigation, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-COLORS-2331906Exploit, Third Party Advisory

Published

Jan 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23556The package guake before 3.8.5 are vulnerable to Exposed Dan…8
• CVE-2021-23558The package bmoor before 0.10.1 are vulnerable to Prototype …9.8
• CVE-2021-2356Vulnerability in the MySQL Server product of Oracle MySQL (c…5.9
• CVE-2021-23561All versions of package comb are vulnerable to Prototype Pol…9.8
• CVE-2021-23562This affects the package plupload before 2.3.9. A file name …8.8
• CVE-2021-23566The package nanoid from 3.0.0 and before 3.1.31 are vulnerab…5.5
• CVE-2021-23568The package extend2 before 1.0.1 are vulnerable to Prototype…9.8
• CVE-2021-2357Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23574All versions of package js-data are vulnerable to Prototype …9.8
• CVE-2021-2358Vulnerability in the Oracle Access Manager product of Oracle…4.9
• CVE-2021-2359Vulnerability in the Oracle Marketing product of Oracle E-Bu…8.2
• CVE-2021-23592The package topthink/framework before 6.0.12 are vulnerable …9.8