CVE-2026-41680

HIGH

Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer

Title source: cna
STIX 2.1

Description

Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.

References (1)

Core 1
Core References

Scores

CVSS v3 7.5
EPSS 0.0034
EPSS Percentile 25.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-400 CWE-674 CWE-835
Status published
Products (3)
marked_project/marked 18.0.0 - 18.0.2
markedjs/marked >= 18.0.0, < 18.0.2
npm/marked 18.0.0 - 18.0.2npm
Published Apr 24, 2026
Tracked Since Apr 24, 2026