CVE-2026-41680: Denial of Service Vulnerability in marked Package Due to Infinite Recursion
Summary
CVE-2026-41680: Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer. Affects marked versions >= 18.0.0, < 18.0.2. Fixed in 18.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The marked package is a widely-used Markdown parser for Node.js, enabling developers to convert Markdown text into HTML. It is known for its speed and flexibility, making it a popular choice for applications that require Markdown processing. However, a critical vulnerability has been identified in version 18.0.0 that can lead to Denial of Service (DoS) through unbounded memory allocation.
Vulnerability Detail
A critical Denial of Service (DoS) vulnerability exists in marked@18.0.0, triggered by a specific 3-byte input sequence consisting of a tab, a vertical tab, and a newline. This vulnerability arises from the block tokenizer's mishandling of unexpected whitespace characters, leading to an infinite recursion loop during parsing. As a result, memory allocation grows indefinitely, ultimately causing the Node.js application to crash due to Memory Exhaustion (OOM). The vulnerability is severe, requiring no authentication and only minimal input from an attacker, making it easy to exploit.
How To Fix
Latest published version: 18.1.1 as of 23 Oct 2026
npm install marked@18.1.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
18.0.2
This is the first release that contains the fix.
npm install marked@18.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted user input with the marked package until you can apply the patch. Additionally, you can implement input validation to filter out the specific 3-byte sequence that triggers the vulnerability.
Conclusion
The vulnerability identified as CVE-2026-41680 in the marked package poses a significant risk of Denial of Service due to infinite recursion triggered by specific input. It is crucial to update to the patched version to safeguard your applications and maintain service availability.
See every vulnerability recorded for marked →
FAQ
The vulnerability affects marked versions 18.0.0 and earlier. It is fixed in version 18.0.2.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Yes, you can implement input validation to filter out the specific 3-byte sequence that causes the issue as a temporary measure.
If left unaddressed, this vulnerability can allow an unauthenticated attacker to crash your application, leading to a loss of availability and potential service disruption.
References
Related vulnerabilities
Recent vulnerabilities recorded for marked.
