Description
Versions 0.3.3 and earlier of marked are affected by a regular expression denial of service ( ReDoS ) vulnerability when passed inputs that reach the em inline rule.
Recommendation
Update the marked package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.3.4
- Patched version(s): 0.3.4
References
- GHSA-hjcp-j389-59ff
- www.npmjs.com
- www.owasp.org
- lists.fedoraproject.org
- support.f5.com
- www.openwall.com
- CVE-2015-8854
- CWE-1333
- CAPEC-310
- OWASP 2021-A6
Related Issues
- counterpart vulnerable to prototype pollution - CVE-2025-57354
- Marked allows Regular Expression Denial of Service (ReDoS) attacks - CVE-2018-25110
- Parse Server has an OAuth login vulnerability - CVE-2025-30168
- Use of Insufficiently Random Values in undici - CVE-2025-22150
- Tags:
- npm
- marked
Anything's wrong? Let us know Last updated on February 09, 2024