CVE-2022-21681: Inefficient Regular Expression Complexity in marked
Summary
CVE-2022-21681: Inefficient Regular Expression Complexity in marked. Affects marked versions < 4.0.10. Fixed in 4.0.10. How to fix ↓
Also tracked for
- node-marked · Debian:11
The same CVE-2022-21681 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is marked, an open-source library used for parsing and rendering markdown. It provides a simple and efficient way to convert markdown text into HTML. The vulnerability in question is related to the regular expression inline.reflinkSearch used in marked. This regular expression can lead to catastrophic backtracking, resulting in a denial of service (DoS) attack. Any user running untrusted markdown through marked without using a worker with a time limit is susceptible to this vulnerability.
Vulnerability Detail
The vulnerability in marked arises from an inefficient regular expression that can cause catastrophic backtracking. This can be exploited by an attacker to launch a DoS attack by providing specially crafted input that triggers the excessive backtracking. The impact of this vulnerability is a significant drain on system resources, potentially leading to service disruption. It is important to note that this vulnerability does not allow for remote code execution or unauthorized access to sensitive information.
How To Fix
Latest published version: 18.1.1 as of 23 Oct 2026
npm install marked@18.1.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.10
This is the first release that contains the fix.
npm install marked@4.0.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version is not immediately feasible, there is a workaround to mitigate the risk. Users can avoid running untrusted markdown through marked or utilize a worker thread with a time limit. By running marked on a worker thread and setting a reasonable time limit, the risk of resource exhaustion due to the vulnerability can be minimized. More information on using workers with marked can be found at https://marked.js.org/using_advanced#workers.
Conclusion
The vulnerability in marked related to inefficient regular expression complexity can lead to a denial of service (DoS) attack. Users are advised to upgrade to the patched version 4.0.10 or later to mitigate the risk. Alternatively, utilizing a worker thread with a time limit can provide a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for marked →
FAQ
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit is potentially impacted by this vulnerability.
The vulnerability can lead to a denial of service (DoS) attack, causing a significant drain on system resources and potential service disruption.
Yes, the marked library has released a patch in version 4.0.10 to address this vulnerability.
Yes, users can mitigate the risk by avoiding running untrusted markdown through marked or by using a worker thread with a time limit.
More information about regular expression DoS attacks can be found at https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS.
References
Related vulnerabilities
Recent vulnerabilities recorded for marked.
