CVE-2026-41680

Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer

State: Published
Severity: 8.7 High
Published: Apr 24, 2026
Updated: Apr 24, 2026
Reserved: Apr 22, 2026

Description

Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-400 Uncontrolled Resource Consumption
CWE-674 Uncontrolled Recursion
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

Affected Products

Product	Versions
markedmarkedjs	>= 18.0.0, < 18.0.2Affected

References

https://github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.