Regular Expression Denial of Service (ReDoS) in node-marked
Summary
CVE-2015-8854: The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular... Affects node-marked versions < 0.3.6+dfsg-1. Fixed in 0.3.6+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
node-marked is a package for Node.js that allows for parsing and rendering of Markdown files. It is commonly used in web applications to convert Markdown content into HTML. However, versions before 0.3.4 of node-marked are vulnerable to a Regular Expression Denial of Service (ReDoS) attack. This vulnerability can be exploited by attackers to cause a denial of service by consuming excessive CPU resources.
Vulnerability Detail
The vulnerability in node-marked (versions before 0.3.4) is due to a catastrophic backtracking issue in the 'em' inline rule regular expression. Attackers can trigger this issue using unspecified vectors, resulting in a ReDoS attack. This can lead to a significant increase in CPU consumption, causing the application to become unresponsive or crash. The severity of this vulnerability is rated as high, with a CVSS score of 7.5.
How To Fix
Minimum fixed version
0.3.6+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-markedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update node-marked to the fixed version as soon as possible.
Conclusion
The vulnerability in node-marked (versions before 0.3.4) can be exploited by attackers to cause a denial of service by consuming excessive CPU resources. To mitigate this risk, it is crucial to update node-marked to version 0.3.6+dfsg-1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-marked →
FAQ
node-marked is a package for Node.js that allows for parsing and rendering of Markdown files. It is commonly used in web applications to convert Markdown content into HTML.
A Regular Expression Denial of Service (ReDoS) attack is a type of denial of service attack that exploits the exponential time complexity of certain regular expressions. By providing input that triggers excessive backtracking, an attacker can cause the regular expression matching process to take an extremely long time, consuming excessive CPU resources and potentially causing the application to become unresponsive or crash.
This vulnerability allows attackers to cause a denial of service by consuming excessive CPU resources. This can lead to the application becoming unresponsive or crashing, impacting the availability of the service.
Yes, updating node-marked to version 0.3.6+dfsg-1 or later will fix this vulnerability. It is recommended to update the package as soon as possible.
No, there are no known workarounds for this vulnerability. Updating node-marked to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-marked.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
