GitHub Advisoryadvisory · npm

GHSA-xf5p-87ch-gxw2 Marked ReDoS due to email addresses being evaluated in quadratic time

MEDIUM Published 2019-06-05 Modified 2022-08-02 Official page ↗
Ecosystem
npm
Packages
marked
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400
Reviewed
2019-06-05

Affected packages

• npm marked: >= 0.3.14, < 0.6.2 → fixed in 0.6.2

Description

Versions of `marked` from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion. Recommendation Upgrade to version 0.6.2 or later.

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References