Regular Expression Denial of Service (REDoS) in Marked

CAO 7.5CVE-2021-21306 · GHSA-4r62-v4vq-hr96 · Công bố 08/02/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-21306 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng marked (marked project), marked.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 2.5%, cao hơn 84.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.0.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
marked marked_project	`≥ 1.1.1, < 2.0.0`	`2.0.0`
marked npm	`≥ 1.1.1, < 2.0.0`	`2.0.0`

Mô tả

Impact

What kind of vulnerability is it? Who is impacted?

Regular expression Denial of Service

A Denial of Service attack can affect anyone who runs user generated code through marked.

Patches

Has the problem been patched? What versions should users upgrade to?

patched in v2.0.0

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

None.

References

Are there any links users can visit to find out more?

https://github.com/markedjs/marked/issues/1927 https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

For more information

If you have any questions or comments about this advisory:

Open an issue in marked

Mô tả của NVD

Marked is an open-source markdown parser and compiler (npm package "marked"). In marked from version 1.1.1 and before version 2.0.0, there is a Regular expression Denial of Service vulnerability. This vulnerability can affect anyone who runs user generated code through marked. This vulnerability is fixed in version 2.0.0.