GitHub Advisoryadvisory · npm

GHSA-x5pg-88wf-qq4p Regular Expression Denial of Service in marked

HIGH Published 2018-07-24 Modified 2023-09-07 Official page ↗
Aliases
CVE-2017-16114
Ecosystem
npm
Packages
marked
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2020-06-16

Affected packages

• npm marked: < 0.3.9 → fixed in 0.3.9

Description

Affected versions of `marked` are vulnerable to a regular expression denial of service. The amplification in this vulnerability is significant, with 1,000 characters resulting in the event loop being blocked for around 6 seconds. Recommendation Update to version 0.3.9 or later.

Related

Alias · CVE (1)

  • CVE-2017-16114 The marked module is vulnerable to a regular expression denial of service. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References