CVE-2015-8854: Regular Expression Denial of Service in marked
Summary
CVE-2015-8854: Regular Expression Denial of Service in marked. Affects marked versions < 0.3.4. Fixed in 0.3.4. How to fix ↓
Also tracked for
- node-marked · Debian:11
The same CVE-2015-8854 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The marked package is an open-source library for parsing and rendering Markdown. It is commonly used in web applications to convert Markdown syntax into HTML. The package provides a simple and efficient way to process Markdown content and display it on websites. However, versions 0.3.3 and earlier of marked are vulnerable to a regular expression denial of service (ReDoS) attack when certain inputs are passed to the em inline rule.
Vulnerability Detail
The vulnerability in marked arises from a regular expression pattern used in the em inline rule. This pattern can be exploited by an attacker to cause a denial of service (DoS) by providing a specially crafted input that triggers excessive backtracking in the regular expression engine. This can lead to a significant slowdown or even freezing of the application, rendering it unresponsive. The impact of this vulnerability can be severe, as it allows an attacker to disrupt the availability of the affected application.
How To Fix
Minimum fixed version
0.3.4
This is the first release that contains the fix.
npm install marked@0.3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to update to the latest version of the marked package.
Conclusion
The marked package versions 0.3.3 and earlier are vulnerable to a regular expression denial of service (ReDoS) attack. This can lead to a denial of service (DoS) situation where the application becomes unresponsive. To mitigate this vulnerability, it is crucial to update to version 0.3.4 or later of the marked package. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for marked →
FAQ
The vulnerability allows an attacker to cause a denial of service (DoS) by exploiting the regular expression pattern used in the marked package. This can lead to a significant slowdown or freezing of the application, rendering it unresponsive.
Versions 0.3.3 and earlier of marked are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
Yes, updating to version 0.3.4 or later of the marked package fixes this vulnerability. It is recommended to update to the latest version to ensure the security of your application.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-hjcp-j389-59ff/GHSA-hjcp-j389-59ff.json
Related vulnerabilities
Recent vulnerabilities recorded for marked.
