Description
Affected versions of marked are vulnerable to a regular expression denial of service.
The amplification in this vulnerability is significant, with 1,000 characters resulting in the event loop being blocked for around 6 seconds.
Recommendation
Update the marked package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.3.9
- Patched version(s): 0.3.9
References
Related Issues
- Regular Expression Denial of Service in slug - CVE-2017-16117
- Regular Expression Denial of Service in moment - CVE-2017-18214
- Regular Expression Denial of Service in string package - CVE-2017-16116
- Regular Expression Denial of Service in timespan - CVE-2017-16115
You might also like:
- Tags:
- npm
- marked
Anything's wrong? Let us know Last updated on September 07, 2023