GHSA-xf5p-87ch-gxw2
GHSA-xf5p-87ch-gxw2 · Marked ReDoS due to email addresses being evaluated in quadratic time
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Versions of `marked` from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion. ## Recommendation Upgrade to version 0.6.2 or later.
CVSS 5.3 · Medium · Fix available
- Published
- Updated
Stack: node
Affected products and versions
marked npm
- Affected ranges
- SEMVER: ≥ 0.3.14, < 0.6.2
Update to 0.6.2
Original sources
- https://github.com/markedjs/marked/pull/1460
- https://github.com/markedjs/marked/commit/b15e42b67cec9ded8505e9d68bb8741ad7a9590d
- https://github.com/markedjs/marked
- https://github.com/markedjs/marked/releases/tag/v0.6.2
- https://snyk.io/vuln/SNYK-JS-MARKED-174116
- https://www.npmjs.com/advisories/812
- https://osv.dev/vulnerability/GHSA-xf5p-87ch-gxw2