HIGH🇵🇱 Wersja polska

CVE-2026-41680

CVSS 8.7v4.0pub. 2026-04-24upd. 2026-04-28

Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Marked Project Marked

    APP
    Marked Project
    18.0.0 – 18.0.2 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth BypassDoS
CWE
References

Related vulnerabilities

CVE-2022-21680HIGH7.5ten sam produkt

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may caus...

CVE-2022-21681HIGH7.5ten sam produkt

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearc...

CVE-2017-16114HIGH7.5ten sam produkt

The marked module is vulnerable to a regular expression denial of service. Based on the information published ...

CVE-2015-8854HIGH7.5ten sam produkt

The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) vi...

CVE-2018-25110MEDIUM6.9ten sam produkt

Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to c...