Regular Expression Denial of Service Vulnerability in node-marked Package
Summary
CVE-2018-25110: Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. Affects node-marked across 3 version ranges.
< 0.5.1+dfsg-1
< 20bfc106013ed45713a21672ad4a34df94dcd485
< 4252cad46232530a87215aa32d30a97f20b3c44f
Fixed in 0.5.1+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-marked package is a widely used Markdown parser for Node.js applications, enabling developers to convert Markdown text into HTML. It is known for its speed and flexibility, making it a popular choice among developers. However, prior to version 0.3.17, it is susceptible to a Regular Expression Denial of Service (ReDoS) attack, which can severely impact application performance and availability.
Vulnerability Detail
The vulnerability arises from catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes. This can cause the parser to hang, leading to a Denial of Service, where legitimate users are unable to access the application.
How To Fix
Minimum fixed version
0.5.1+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-markedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider sanitizing user input to prevent deeply nested structures or limiting the complexity of markdown that can be processed by the application. This can be done by implementing input validation checks before passing data to the node-marked parser.
Conclusion
The node-marked package is vulnerable to a Regular Expression Denial of Service attack in versions prior to 0.3.17. It is crucial to update to the patched version to ensure application security and performance. Additionally, implementing input validation can serve as a temporary workaround while the update is applied.
See every vulnerability recorded for node-marked →
FAQ
A ReDoS attack exploits the way certain regular expressions are processed, causing the application to consume excessive resources and potentially crash.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to analyze your manifest file without requiring any signup.
Failure to address this vulnerability can lead to application downtime, loss of user trust, and potential financial losses due to service interruptions.
No, the vulnerability exists in versions prior to 0.3.17. Versions 0.5.1+dfsg-1 and later have been patched.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities, helping developers maintain secure applications.
Related vulnerabilities
Recent vulnerabilities recorded for node-marked.
