p PatchFirst

CVE-2026-41680

CVE-2026-41680 · Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.

CVSS 8.7 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • marked

    Versions
    • >= 18.0.0, < 18.0.2: Affected

    No fix published

  • marked npm

    Affected ranges
    • SEMVER: ≥ 18.0.0, < 18.0.2

    Update to 18.0.2

Original sources

Check your server →