Skip to content
OpenAdvisories
High · 7.5 CVE-2022-21680 EUVD-2022-0691GHSA-rrrm-qjm4-v8hf

Cubic catastrophic backtracking (ReDoS) in marked

Published Jan 14, 2022 · Updated Apr 22, 2025 · Assigned by GitHub_M

Description

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

Affected products

VendorProductAffectedFixed
markedjs marked < 4.0.10 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 node-marked 4.0.12+ds+~4.0.1-1 —
Debian 13 node-marked 4.0.12+ds+~4.0.1-1 —
Debian 12 node-marked 4.0.12+ds+~4.0.1-1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 node-marked No fix yet —
Ubuntu 26.04 LTS node-marked No fix yet —
Ubuntu 25.10 node-marked No fix yet —
Ubuntu 24.04 LTS node-marked No fix yet —
Ubuntu 22.04 LTS node-marked No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS node-marked No fix yet —
Ubuntu 18.04 LTS node-marked No fix yet —
Ubuntu 16.04 LTS node-marked No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
npm marked < 4.0.10 4.0.10 GHSA-rrrm-qjm4-v8hf

Advisories 1

References