color-string (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package color-string, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (2)

• CVE-2025-59142: color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-string was taken…
• CVE-2021-29060 — CVSS 5.3 (medium): A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the…