CVE-2022-21680: Inefficient Regular Expression Complexity in marked
Summary
CVE-2022-21680: Inefficient Regular Expression Complexity in marked. Affects marked versions < 4.0.10. Fixed in 4.0.10. How to fix ↓
Also tracked for
- node-marked · Debian:11
The same CVE-2022-21680 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'marked' package is an open-source library used for parsing and rendering Markdown. It is commonly used in applications that involve processing and displaying Markdown content. This vulnerability affects versions of 'marked' prior to 4.0.10. The package provides a function called 'marked.parse' which is responsible for parsing Markdown input and converting it into HTML output.
Vulnerability Detail
The vulnerability in 'marked' is related to inefficient regular expression complexity. Specifically, the regular expression 'block.def' used in the library may cause catastrophic backtracking against certain strings. This can lead to a denial of service (DoS) scenario where the application becomes unresponsive or consumes excessive resources. An attacker can exploit this vulnerability by providing specially crafted Markdown input that triggers the inefficient regular expression. The impact of this vulnerability is a potential DoS attack against applications that use 'marked' to parse untrusted Markdown content.
How To Fix
Latest published version: 18.1.1 as of 23 Oct 2026
npm install marked@18.1.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.10
This is the first release that contains the fix.
npm install marked@4.0.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version is not immediately feasible, users can implement a workaround by avoiding the execution of untrusted Markdown content through 'marked'. Alternatively, users can run 'marked' on a worker thread with a time limit to prevent resource exhaustion. More information on using workers with 'marked' can be found in the documentation: https://marked.js.org/using_advanced#workers
Conclusion
Inefficient regular expression complexity in the 'marked' package can lead to a denial of service (DoS) vulnerability. Users should upgrade to version 4.0.10 or later to fix this issue. Alternatively, they can implement workarounds such as avoiding untrusted Markdown input or using a worker thread with a time limit. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for marked →
FAQ
Anyone who runs untrusted Markdown through 'marked' and does not use a worker with a time limit is potentially affected.
The impact is a potential denial of service (DoS) attack, where the application becomes unresponsive or consumes excessive resources.
Yes, the vulnerability has been patched in version 4.0.10 of the 'marked' package.
Yes, users can avoid running untrusted Markdown through 'marked' or use a worker thread with a time limit to prevent resource exhaustion.
More information about regular expression DoS attacks can be found in the OWASP documentation: https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
References
Related vulnerabilities
Recent vulnerabilities recorded for marked.
