Packages / marked / Security

ModerateVulnerabilityGHSA-xf5p-87ch-gxw2Published 5 Jun 2019

Marked ReDoS due to email addresses being evaluated in quadratic time

Affected · marked

  • >= 0.3.14, < 0.6.2

Fixed in

0.6.2

npm install marked@0.6.2

  1. Not affected

    0.0.1 – 0.3.13

    41 releases

  2. Affected

    0.3.14 – 0.6.1

    12 releases

  3. Fixed

    0.6.2 – 18.1.1

    172 releases, latest

225 stable releases of marked, oldest to newest.

What happens

Versions of marked from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion.

Recommendation

Upgrade to version 0.6.2 or later.