GitHub Advisoryadvisory · npm

GHSA-ch52-vgq2-943f Regular Expression Denial of Service in marked

LOW Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
marked
Severity
Low
Weaknesses
CWE-1333
Reviewed
2020-08-31

Affected packages

• npm marked: >= 0.4.0, < 0.7.0 → fixed in 0.7.0

Description

Affected versions of `marked` are vulnerable to Regular Expression Denial of Service (ReDoS). The `_label` subrule may significantly degrade parsing performance of malformed input. Recommendation Upgrade to version 0.7.0 or later.

Related

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References