Regular Expression Denial of Service Vulnerability in Node-marked Package
Summary
DEBIAN-CVE-2018-25110: Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. Affects node-marked versions < 0.5.1+dfsg-1. Fixed in 0.5.1+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node-marked is a popular JavaScript library used for parsing and converting Markdown into HTML. It is widely utilized in web applications to facilitate the rendering of Markdown content. However, certain versions of this package are vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which can severely impact application performance and availability.
Vulnerability Detail
The vulnerability in Node-marked arises from catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. This flaw allows an attacker to craft specially structured markdown input, such as deeply nested brackets or repetitive tag attributes, causing the parser to hang. As a result, this can lead to a Denial of Service, where legitimate users are unable to access the application due to its unresponsiveness.
How To Fix
Minimum fixed version
0.5.1+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-markedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to restrict the types of markdown input that can be processed. This can help mitigate the risk of an attacker exploiting the vulnerability.
Conclusion
The Node-marked package is vulnerable to a ReDoS attack due to flaws in its regular expressions. It is crucial to update to version 0.5.1+dfsg-1 to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-marked →
FAQ
A ReDoS attack exploits the way certain regular expressions are processed, causing the application to consume excessive resources and potentially become unresponsive.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply uploading your manifest file, such as package-lock.json, you can receive real-time alerts regarding vulnerabilities.
Symptoms may include slow performance, application hangs, or complete unresponsiveness when processing certain markdown inputs.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Implement input validation to restrict the types of markdown input processed by your application until you can update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-marked.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
