~ / search / GHSA-x5pg-88wf-qq4p

GHSA-x5pg-88wf-qq4p

Regular Expression Denial of Service in marked

Source: GitHub Advisory Database (reviewed) High CVE-2017-16114

Packages

EcosystemPackageAffectedFixed in
npm marked < 0.3.9 0.3.9

Details

As written in the advisory (Markdown source, shown as plain text).

Affected versions of `marked` are vulnerable to a regular expression denial of service. The amplification in this vulnerability is significant, with 1,000 characters resulting in the event loop being blocked for around 6 seconds. ## Recommendation Update to version 0.3.9 or later.

References

External links from the advisory. They lead to third-party sites.