marked

18.1.1 · 12 Oct 2026MIT51.2M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Line	Newest	Where it stands
	18.1.1	Safe from 18.0.2
	17.0.6	No known advisory
	16.4.2	No known advisory
	4.3.0	52 open advisories, worst high · last release Mar 2023, no longer updated

Your version

High
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked TokenizerGHSA-6v9c-7cg6-27q7 · 29 Apr 2026
- 18.x18.0.0 – 18.0.1Fixed in 18.0.2
High
Inefficient Regular Expression Complexity in markedGHSA-5v2h-r2cx-5xgj · 14 Jan 2022
- 4.x4.0.0 – 4.0.9Fixed in 4.0.10
- 3.x and older0.0.1 – 3.0.8No fix, no longer updated · move to 4.0.10
High
Inefficient Regular Expression Complexity in markedGHSA-rrrm-qjm4-v8hf · 14 Jan 2022
- 4.x4.0.0 – 4.0.9Fixed in 4.0.10
- 3.x and older0.0.1 – 3.0.8No fix, no longer updated · move to 4.0.10
High
Regular Expression Denial of Service in markedGHSA-x5pg-88wf-qq4p · 24 Jul 2018
- 0.3.x0.3.0 – 0.3.7Fixed in 0.3.9
- 0.2.x and older0.0.1 – 0.2.10No fix, no longer updated · move to 0.3.9
High
Regular Expression Denial of Service in markedGHSA-hjcp-j389-59ff · 24 Oct 2017
- 0.3.x0.3.0 – 0.3.3Fixed in 0.3.4
- 0.2.x and older0.0.1 – 0.2.10No fix, no longer updated · move to 0.3.4
Moderate
Marked allows Regular Expression Denial of Service (ReDoS) attacksGHSA-p9wx-2529-fp83 · 23 May 2025
- 0.3.x0.3.0 – 0.3.16Fixed in 0.3.17
- 0.2.x and older0.0.1 – 0.2.10No fix, no longer updated · move to 0.3.17
Moderate
Regular Expression Denial of Service (REDoS) in MarkedGHSA-4r62-v4vq-hr96 · 8 Feb 2021
- 1.x1.1.1 – 1.2.9No fix on 1.x
Moderate
Multiple Content Injection Vulnerabilities in markedGHSA-9cw2-jqp5-7x39 · 31 Aug 2020
- 0.3.x0.3.0Fixed in 0.3.1
- 0.2.x and older0.0.1 – 0.2.10No fix, no longer updated · move to 0.3.1
Moderate
Marked ReDoS due to email addresses being evaluated in quadratic timeGHSA-xf5p-87ch-gxw2 · 5 Jun 2019
- 0.6.x0.6.0 – 0.6.1Fixed in 0.6.2
- 0.5.x and older0.3.14 – 0.5.2No fix, no longer updated · move to 0.6.2
Moderate
Sanitization bypass using HTML Entities in markedGHSA-vfvf-mqq8-rwqc · 18 Feb 2019
- 0.3.x0.3.0 – 0.3.5Fixed in 0.3.6
- 0.2.x and older0.0.1 – 0.2.10No fix, no longer updated · move to 0.3.6
Moderate
Marked vulnerable to XSS from data URIsGHSA-7px7-7xjx-hxm8 · 4 Jan 2018
- 0.3.x0.3.0 – 0.3.6Fixed in 0.3.7
- 0.2.x and older0.0.1 – 0.2.10No fix, no longer updated · move to 0.3.7
Moderate
VBScript Content Injection in markedGHSA-cfjh-p3g4-3q2f · 24 Oct 2017
- 0.3.x0.3.0 – 0.3.2Fixed in 0.3.3
- 0.2.x and older0.0.1 – 0.2.10No fix, no longer updated · move to 0.3.3
Low
Regular Expression Denial of Service in markedGHSA-ch52-vgq2-943f · 3 Sept 2020
- 0.6.x and older0.4.0 – 0.6.3No fix, no longer updated

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 20 October 2026. Releases and advisories last read 20 October 2026.