# CVE-2018-25110: Marked Regular Expression Denial of Service (ReDoS)

Source: https://junglewise.ai/threats/cve-2018-25110-marked-regular-expression-denial-of-service-redos  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-05-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2018-25110 · Severity: medium · CVSS 4 · Published 2025-05-23

Marked is a popular JavaScript markdown parser library used to convert markdown text into HTML. Versions before 0.3.17 contain multiple regular expressions that are vulnerable to catastrophic backtracking, allowing an attacker to craft specially formatted markdown input that causes the parser to hang and consume excessive CPU resources, effectively disabling any service that processes untrusted markdown content.

Technologies: [marked (npm)](https://junglewise.ai/threats/technologies/npm-marked). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2018-25110 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-25110 being exploited in the wild.

**How severe is CVE-2018-25110?** Medium severity, with a CVSS score of 4, published 23 May 2025.

**Which products and versions are affected?** marked (npm) SEMVER:introduced=0,fixed=0.3.17.

**Is there a fix for CVE-2018-25110?** Yes. marked (npm): upgrade to 0.3.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-25110 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2018-25110?** Check whether you run marked (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- marked (npm): upgrade to 0.3.17 or later

  ```sh
  npm install marked@0.3.17
  ```


## Technical details

The vulnerability involves Regular Expression Denial of Service (ReDoS) attacks exploiting catastrophic backtracking in multiple regex patterns used for parsing HTML tags and markdown links. The vulnerable patterns, found in lib/marked.js, include expressions for link parsing (with exponential blow-up) and HTML tag attribute parsing (with power-law blow-up). An attacker with the ability to submit markdown input can trigger these regexes with specially crafted payloads such as deeply nested brackets or repetitively structured tag attributes. No authentication is required; the vulnerability is reachable directly through any input that is parsed by Marked. An attacker can achieve denial of service by blocking the JavaScript event loop for extended periods. The vulnerability is fixed in version 0.3.17 and later.

## Affected products

- Marked Marked prior to 0.3.17

## Identifiers

- CVE-2018-25110
- GHSA-p9wx-2529-fp83

## Timeline

- 2025-05-23: disclosed
- 2025-05-27: advisory

## References

- [https://github.com/markedjs/marked/issues/1070](https://github.com/markedjs/marked/issues/1070)

## Related threats

- [marked Denial of Service via infinite recursion in tokenizer](https://junglewise.ai/threats/cve-2026-41680-marked-denial-of-service-via-infinite-recursion-in-tokenizer)
- [marked Regular Expression Denial of Service in inline.reflinkSearch](https://junglewise.ai/threats/cve-2022-21681-marked-regular-expression-denial-of-service-in-inline)
- [marked ReDoS in block.def regular expression](https://junglewise.ai/threats/cve-2022-21680-marked-redos-in-block-def-regular-expression)
- [marked content injection in autolink](https://junglewise.ai/threats/marked-content-injection-in-autolink-0c735c59)
- [marked Regular Expression Denial of Service](https://junglewise.ai/threats/marked-regular-expression-denial-of-service-501371b1)