Marked ReDoS Vulnerability in npm/marked
Summary
GHSA-xf5p-87ch-gxw2: Marked ReDoS due to email addresses being evaluated in quadratic time. Affects marked versions >= 0.3.14, < 0.6.2. Fixed in 0.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The marked package is an open-source library in the npm ecosystem. It is commonly used for parsing and rendering Markdown content. The library provides a simple and efficient way to convert Markdown syntax into HTML. However, versions 0.3.14 to 0.6.2 of marked are vulnerable to a Regular Expression Denial of Service (ReDoS) attack. This vulnerability arises from the evaluation of email addresses in quadratic time, which can lead to resource exhaustion and potential crashes of the node process.
Vulnerability Detail
The vulnerability in marked allows attackers to exploit the way email addresses are processed, resulting in a ReDoS attack. By providing specially crafted email addresses, an attacker can cause the node process to consume excessive resources, leading to denial of service. The vulnerability has a moderate severity rating with a CVSS score of 5.3. It is important to note that this vulnerability only affects versions 0.3.14 to 0.6.2 of the marked package.
How To Fix
Latest published version: 18.1.1 as of 23 Oct 2026
npm install marked@18.1.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.2
This is the first release that contains the fix.
npm install marked@0.6.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of the marked package.
Conclusion
The marked package versions 0.3.14 to 0.6.2 are vulnerable to a ReDoS attack due to the evaluation of email addresses in quadratic time. To mitigate this vulnerability, it is crucial to upgrade to version 0.6.2 or later. For further assistance and support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for marked →
FAQ
The vulnerability can potentially crash the node process due to resource exhaustion, leading to denial of service.
Versions 0.3.14 to 0.6.2 of the marked package are affected by this vulnerability.
ReDoS stands for Regular Expression Denial of Service. It is a type of attack where an attacker provides input that causes a regular expression to take a long time to evaluate, leading to resource exhaustion and potential denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
There is no known exploit for this vulnerability at the moment. However, it is still important to upgrade to the fixed version to prevent any potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for marked.
