Denial of Service Vulnerability in Marked Markdown Parser by Marked

CVE-2026-41680

What is CVE-2026-41680?

Marked, a popular markdown parser and compiler, has a Denial of Service vulnerability that affects versions 18.0.0 and 18.0.1. An unauthenticated attacker can exploit this vulnerability by supplying a specific sequence of 3 bytes—namely a tab, a vertical tab, and a newline character—causing an infinite recursion loop during the parsing process. This exploitation leads to unbounded memory allocation, inevitably resulting in the Node.js application crashing due to memory exhaustion. Users are advised to upgrade to version 18.0.2 or later to mitigate this risk.

References