GitHub Advisoryadvisory · npm

GHSA-hjcp-j389-59ff Regular Expression Denial of Service in marked

HIGH Published 2017-10-24 Modified 2024-02-09 Official page ↗
Aliases
CVE-2015-8854
Ecosystem
npm
Packages
marked
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333
Reviewed
2020-06-16

Affected packages

• npm marked: < 0.3.4 → fixed in 0.3.4

Description

Versions 0.3.3 and earlier of `marked` are affected by a regular expression denial of service ( ReDoS ) vulnerability when passed inputs that reach the `em` inline rule. Recommendation Update to version 0.3.4 or later.

Related

Alias · CVE (1)

  • CVE-2015-8854 The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References