GHSA-x5pg-88wf-qq4pHighCVSS 7.5

Regular Expression Denial of Service in marked

Published
July 24, 2018
Last Modified
September 7, 2023

🔗 CVE IDs covered (1)

CVE-2017-16114 →

📋 Description

Affected versions of marked are vulnerable to a regular expression denial of service.

The amplification in this vulnerability is significant, with 1,000 characters resulting in the event loop being blocked for around 6 seconds.

Recommendation

Update to version 0.3.9 or later.

🎯 Affected products1

  • npm/marked:< 0.3.9

🔗 References (4)