Packages / marked / Security

HighVulnerabilityGHSA-hjcp-j389-59ffCVE-2015-8854Published 24 Oct 2017

Regular Expression Denial of Service in marked

Affected · marked

  • < 0.3.4

Fixed in

0.3.4

npm install marked@0.3.4

  1. Affected

    0.0.1 – 0.3.3

    34 releases

  2. Fixed

    0.3.4 – 18.1.1

    191 releases, latest

225 stable releases of marked, oldest to newest.

What happens

Versions 0.3.3 and earlier of marked are affected by a regular expression denial of service ( ReDoS ) vulnerability when passed inputs that reach the em inline rule.

Recommendation

Update to version 0.3.4 or later.