CVE-2017-16114: Regular Expression Denial of Service in marked
Summary
CVE-2017-16114: Regular Expression Denial of Service in marked. Affects marked versions < 0.3.9. Fixed in 0.3.9. How to fix ↓
Also tracked for
- node-marked · Debian:11
The same CVE-2017-16114 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The marked package is an open-source library used for parsing and rendering Markdown content. It is commonly used in web applications and other projects to convert Markdown syntax into HTML. The vulnerability in marked allows for a regular expression denial of service attack, where a specially crafted input can cause the event loop to be blocked for a significant amount of time. This can lead to a degradation in performance and potentially a denial of service if the application relies heavily on the marked library for Markdown rendering.
Vulnerability Detail
The vulnerability in marked is due to a regular expression that can be exploited to cause a denial of service. By providing a string with a large number of characters that match the regular expression pattern, the event loop of the application can be blocked for several seconds. This can be used by an attacker to degrade the performance of the application or even cause a complete denial of service. The vulnerability has been assigned a severity rating of HIGH.
How To Fix
Latest published version: 18.1.1 as of 23 Oct 2026
npm install marked@18.1.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.9
This is the first release that contains the fix.
npm install marked@0.3.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the marked package to the latest version as soon as possible.
Conclusion
The marked package is vulnerable to a regular expression denial of service attack. To mitigate this vulnerability, it is crucial to update to version 0.3.9 or later of the package. This will ensure that the application is no longer susceptible to the denial of service attack and maintain optimal performance. For additional support and guidance, reach out to DevNack.com.
See every vulnerability recorded for marked →
FAQ
The vulnerability can lead to a denial of service if the application relies heavily on the marked library for Markdown rendering. It can also cause a degradation in performance, resulting in slower response times.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide the package-lock.json file of your application and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the moment. However, it is always recommended to update to the latest version of the affected package to mitigate any potential risks.
It is not recommended to manually fix the vulnerability without updating the package. The fix provided in the latest version of the marked package includes necessary changes to address the vulnerability effectively.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance on fixing the vulnerability in your application.
Related vulnerabilities
Recent vulnerabilities recorded for marked.
