Denial of Service Vulnerability in node-marked Package
Summary
DEBIAN-CVE-2015-8854: The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular... Affects node-marked versions < 0.3.6+dfsg-1. Fixed in 0.3.6+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The node-marked package is a Markdown parser and compiler for Node.js, widely used for converting Markdown text into HTML. It is known for its speed and flexibility, making it a popular choice among developers. However, prior to version 0.3.4, the package is susceptible to a vulnerability that can lead to denial of service (DoS) attacks due to inefficient handling of certain input patterns.
Vulnerability Detail
The vulnerability in the node-marked package arises from a catastrophic backtracking issue in the regular expression used for parsing inline Markdown elements. Attackers can exploit this flaw by crafting specific input that causes excessive CPU consumption, leading to service unavailability. This type of attack is classified as a regular expression denial of service (ReDoS), which can severely impact application performance and user experience.
How To Fix
Minimum fixed version
0.3.6+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-markedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to filter out potentially malicious Markdown input before it reaches the node-marked parser. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The node-marked package has a significant vulnerability that can lead to denial of service attacks. It is crucial for users to update to the latest version to protect their applications. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for node-marked →
FAQ
The vulnerability is a denial of service (DoS) issue caused by catastrophic backtracking in regular expressions, which can lead to high CPU usage.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your manifest file.
Versions of node-marked prior to 0.3.4 are vulnerable to this denial of service issue.
Yes, updating to version 0.3.6+dfsg-1 or later will resolve the vulnerability.
If an immediate update is not possible, implement input validation to mitigate the risk of exploitation until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-marked.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
