GHSA-crmx-v835-hcp4 CVE-2017-17461

Moderate severity vulnerability that affects marked

Medium Withdrawn Dec 2, 2021 npm

Severity: Medium; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 0.3.9; Upgrade marked to this version or later

Description

Withdrawn

This advisory has been withdrawn, per NVD: "This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue."

Original Description

A Regular expression Denial of Service (ReDoS) vulnerability in the file marked.js of the marked npm package (tested on version 0.3.7) allows a remote attacker to overload and crash a server by passing a maliciously crafted string.

Affected versions

npm

Package	Vulnerable	Fixed in
marked	`< 0.3.9`	`0.3.9`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

marked npm → `0.3.9`

npm

npm install marked@0.3.9

yarn

yarn add marked@0.3.9

pnpm

pnpm add marked@0.3.9

References

Advisories

Timeline

Jan 4, 2018 Published
Dec 2, 2021 Withdrawn
Sep 10, 2026 Last updated by the source

Advisory	Severity	Why it's related
GHSA-6v9c-7cg6-27q7 Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer	High	Also affects marked
GHSA-p9wx-2529-fp83 Marked allows Regular Expression Denial of Service (ReDoS) attacks	Medium	Also affects marked
GHSA-5v2h-r2cx-5xgj Inefficient Regular Expression Complexity in marked	High	Also affects marked
GHSA-rrrm-qjm4-v8hf Inefficient Regular Expression Complexity in marked	High	Also affects marked
GHSA-4r62-v4vq-hr96 Regular Expression Denial of Service (REDoS) in Marked	High	Also affects marked
GHSA-ch52-vgq2-943f Regular Expression Denial of Service in marked	Low	Also affects marked
GHSA-9cw2-jqp5-7x39 Multiple Content Injection Vulnerabilities in marked	Medium	Also affects marked
GHSA-xf5p-87ch-gxw2 Marked ReDoS due to email addresses being evaluated in quadratic time	Medium	Also affects marked

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor