Denial of Service Vulnerability in Node-marked Package
Summary
DEBIAN-CVE-2022-21681: Marked is a markdown parser and compiler. Affects node-marked versions < 4.0.12+ds+~4.0.1-1. Fixed in 4.0.12+ds+~4.0.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-marked is a markdown parser and compiler used in various applications to convert markdown text into HTML. It is widely utilized due to its efficiency and ease of integration. However, prior to version 4.0.10, it contained a vulnerability that could lead to denial of service (DoS) when processing untrusted markdown input.
Vulnerability Detail
The vulnerability arises from a regular expression, 'inline.reflinkSearch', which may cause catastrophic backtracking against certain strings. This can lead to excessive resource consumption, resulting in a denial of service. If untrusted markdown is processed without appropriate safeguards, it can severely impact the application's performance and availability.
How To Fix
Minimum fixed version
4.0.12+ds+~4.0.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-markedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid processing untrusted markdown through the marked package. Alternatively, run marked on a worker thread with a set time limit to prevent resource exhaustion. For example, you can implement a worker thread in Node.js as follows:
const { Worker } = require('worker_threads');
const worker = new Worker('./path_to_your_worker.js');
worker.postMessage(markdownInput);
worker.setTimeout(5000);
// Set a timeout of 5 seconds
Conclusion
The node-marked package has a critical vulnerability that can lead to denial of service when processing untrusted markdown. It is essential to update to the patched version or implement workarounds to mitigate the risk. Regular monitoring using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for node-marked →
FAQ
The vulnerability can lead to denial of service, causing applications to become unresponsive when processing certain markdown inputs.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, the vulnerability is patched in version 4.0.12+ds+~4.0.1-1 of the node-marked package.
If you cannot update the package, avoid processing untrusted markdown or run the marked parser in a controlled environment with time limits.
You can find detailed information about this vulnerability in the Debian CVE database or on the Vulert website.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-marked.
