Technical impact
Marked, a popular Markdown parser, contains a flaw that triggers an infinite recursion during tokenization when it encounters a specific three‑byte sequence (0x09 0x0B 0x0A). The unbounded recursion causes the parser to allocate memory without limit, leading to a memory exhaustion condition that crashes the host Node.js process. The vulnerability is a resource exhaustion flaw (CWE‑400) amplified by an unprotected infinite loop (CWE‑835) and integer overflow issues (CWE‑674).
Affected Systems
Marked versions from 18.0.0 up to and including 18.0.1 are impacted. These releases are used in Node.js applications that import the marked library for rendering Markdown. Any environment that passes untrusted content to marked may be affected.
Risk and Exploitability
The CVSS score of 8.7 indicates a high‑severity denial of service weakness. The EPSS score of less than 1% suggests that active exploitation is considered unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker can exploit the issue by feeding the target markdown parser the malicious three‑byte sequence; the attack does not require privileged access or user interaction beyond the ability to supply input to the parser.
Github GHSA