Description
Versions of marked from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion.
Recommendation
Update the marked package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.3.14, < 0.6.2
- Patched version(s): 0.6.2
References
Could your website be exposed too?
SmartScanner can check your website for Marked ReDoS due to email addresses being evaluated in quadratic time and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking - CVE-2025-25285
- @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtrac - CVE-2025-25290
- @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtrack - CVE-2025-25289
- @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Back - CVE-2025-25288
You might also like:
See something that needs correcting? Let us knowUpdated January 11, 2023