Packages / marked / Security

HighVulnerabilityGHSA-x5pg-88wf-qq4pCVE-2017-16114Published 24 Jul 2018

Regular Expression Denial of Service in marked

Affected · marked

  • < 0.3.9

Fixed in

0.3.9

npm install marked@0.3.9

  1. Affected

    0.0.1 – 0.3.7

    38 releases

  2. Fixed

    0.3.9 – 18.1.1

    187 releases, latest

225 stable releases of marked, oldest to newest.

What happens

Affected versions of marked are vulnerable to a regular expression denial of service.

The amplification in this vulnerability is significant, with 1,000 characters resulting in the event loop being blocked for around 6 seconds.

Recommendation

Update to version 0.3.9 or later.