Packages / marked / Security

ModerateVulnerabilityGHSA-4r62-v4vq-hr96CVE-2021-21306Published 8 Feb 2021

Regular Expression Denial of Service (REDoS) in Marked

Affected · marked

  • >= 1.1.1, < 2.0.0

Fixed in

2.0.0

npm install marked@2.0.0

  1. Not affected

    0.0.1 – 1.1.0

    61 releases

  2. Affected

    1.1.1 – 1.2.9

    12 releases

  3. Fixed

    2.0.0 – 18.1.1

    152 releases, latest

225 stable releases of marked, oldest to newest.

What happens

Impact

What kind of vulnerability is it? Who is impacted?

Regular expression Denial of Service

A Denial of Service attack can affect anyone who runs user generated code through marked.

Patches

Has the problem been patched? What versions should users upgrade to?

patched in v2.0.0

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

None.

References

Are there any links users can visit to find out more?

#1927 owasp.org/www-community/attacks/Regular_express…

For more information

If you have any questions or comments about this advisory: