Packages / marked / Security

LowVulnerabilityGHSA-ch52-vgq2-943fPublished 3 Sept 2020

Regular Expression Denial of Service in marked

Affected · marked

  • >= 0.4.0, < 0.7.0

Fixed in

0.7.0

npm install marked@0.7.0

  1. Not affected

    0.0.1 – 0.3.19

    47 releases

  2. Affected

    0.4.0 – 0.6.3

    8 releases

  3. Fixed

    0.7.0 – 18.1.1

    170 releases, latest

225 stable releases of marked, oldest to newest.

What happens

Affected versions of marked are vulnerable to Regular Expression Denial of Service (ReDoS). The _label subrule may significantly degrade parsing performance of malformed input.

Recommendation

Upgrade to version 0.7.0 or later.