GHSA-hjcp-j389-59ff

Regular Expression Denial of Service in marked

Source: GitHub Advisory Database (reviewed) High CVE-2015-8854

Packages

Ecosystem	Package	Affected	Fixed in
npm	marked	< 0.3.4	0.3.4

Details

As written in the advisory (Markdown source, shown as plain text).

Versions 0.3.3 and earlier of `marked` are affected by a regular expression denial of service ( ReDoS ) vulnerability when passed inputs that reach the `em` inline rule. ## Recommendation Update to version 0.3.4 or later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2015-8854 advisory
https://github.com/chjj/marked/issues/497 web
https://github.com/advisories/GHSA-hjcp-j389-59ff advisory
https://github.com/chjj/marked package
https://lists.fedoraproject.org/archives/list/[email protected]/message/BO2RMVVZVV6NFTU46B5RYRK7ZCXYARZS web
https://lists.fedoraproject.org/archives/list/[email protected]/message/M6BJG6RGDH7ZWVVAUFBFI5L32RSMQN2S web
https://support.f5.com/csp/article/K05052081?utm_source=f5support&utm_medium=RSS web
https://www.npmjs.com/advisories/23 web
https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS web
http://www.openwall.com/lists/oss-security/2016/04/20/11 web