Regular Expression Denial of Service in node-marked
Summary
CVE-2017-16114: The marked module is vulnerable to a regular expression denial of service. Affects node-marked across 2 version ranges.
< 0.3.9+dfsg-1
< 3a4f7a5dae661f0844cb7b07e8667b5666ffc83e
Fixed in 0.3.9+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-marked is a popular library used for parsing markdown files in Node.js applications. It provides a simple and efficient way to convert markdown syntax into HTML. However, the library is vulnerable to a regular expression denial of service (ReDoS) attack.
Vulnerability Detail
The vulnerability (CVE-2017-16114) arises from the way node-marked handles regular expressions. An attacker can exploit this vulnerability by providing a specially crafted input that triggers a ReDoS attack. This can lead to a denial of service, where the application becomes unresponsive for a significant amount of time. In this case, a payload of just 1k characters can block the application for approximately 6 seconds.
How To Fix
Minimum fixed version
0.3.9+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-markedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the library is not feasible, you can implement input validation to mitigate the risk of a ReDoS attack. Ensure that user-supplied input is properly validated and limit the length of input strings to prevent excessive backtracking in regular expressions.
Conclusion
The regular expression denial of service vulnerability in node-marked can lead to a denial of service attack, impacting the availability of the application. It is crucial to update the library to the fixed version or implement input validation to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for node-marked →
FAQ
A ReDoS attack is a type of denial of service attack where an attacker provides a malicious input that causes a regular expression to take an excessive amount of time to evaluate. This can lead to a significant impact on the performance of the application.
The vulnerability can result in a denial of service, where the application becomes unresponsive for a significant amount of time. This can disrupt the normal operation of the application and impact its availability.
Yes, updating node-marked to version 0.3.9+dfsg-1 or later will fix the vulnerability. It is recommended to update the library as soon as possible.
Implementing input validation and limiting the length of input strings can help mitigate the risk of a ReDoS attack. However, updating the library to the fixed version is the recommended solution.
You can find more information about this vulnerability, including technical details and the fix, in the official CVE-2017-16114 report: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16114.json
Related vulnerabilities
Recent vulnerabilities recorded for node-marked.
