# CVE-2022-21681: marked Regular Expression Denial of Service in inline.reflinkSearch

Source: https://junglewise.ai/threats/cve-2022-21681-marked-regular-expression-denial-of-service-in-inline  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-01-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-21681 · Severity: low · CVSS 3.1 · Published 2022-01-14

marked is a popular open-source JavaScript markdown parser used to convert markdown text into HTML. The parser contains a regular expression vulnerability in its link reference parsing logic that can be exploited with specially crafted markdown input to consume excessive CPU resources and cause a denial of service. An attacker who can submit untrusted markdown content to an application using marked (without proper resource limits) can hang or crash the service.

Technologies: [marked (npm)](https://junglewise.ai/threats/technologies/npm-marked). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-21681 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-21681 being exploited in the wild.

**How severe is CVE-2022-21681?** Low severity, with a CVSS score of 3.1, published 14 January 2022.

**Which products and versions are affected?** marked (npm) SEMVER:introduced=0,fixed=4.0.10.

**Is there a fix for CVE-2022-21681?** Yes. marked (npm): upgrade to 4.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-21681 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-21681?** Check whether you run marked (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- marked (npm): upgrade to 4.0.10 or later

  ```sh
  npm install marked@4.0.10
  ```


## Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in the `inline.reflinkSearch` regular expression used by marked for parsing markdown link references. The regex exhibits exponential worst-case computational complexity due to catastrophic backtracking when matching certain malformed input patterns. An attacker can craft markdown containing deeply nested escaped brackets (e.g., `[x]: x \[\](\[\](\[\](...)))`) that triggers the vulnerable backtracking behavior. Exploitation requires no authentication or special privileges; the attacker only needs to supply untrusted markdown to the parser. The attack consumes CPU cycles and can exhaust resources on single-threaded execution contexts. Patches are available in version 4.0.10 and later. Mitigation for unpatched systems includes running marked in a worker thread with a configurable timeout.

## Affected products

- markedjs marked < 4.0.10

## Identifiers

- CVE-2022-21681
- GHSA-5v2h-r2cx-5xgj

## Timeline

- 2022-01-14: disclosed
- 2022-01-14: patched: Fixed in version 4.0.10

## References

- [https://github.com/markedjs/marked/security/advisories/GHSA-5v2h-r2cx-5xgj](https://github.com/markedjs/marked/security/advisories/GHSA-5v2h-r2cx-5xgj)
- [https://github.com/markedjs/marked/commit/8f806573a3f6c6b7a39b8cdb66ab5ebb8d55a5f5](https://github.com/markedjs/marked/commit/8f806573a3f6c6b7a39b8cdb66ab5ebb8d55a5f5)
- [https://github.com/markedjs/marked/commit/c4a3ccd344b6929afa8a1d50ac54a721e57012c0](https://github.com/markedjs/marked/commit/c4a3ccd344b6929afa8a1d50ac54a721e57012c0)
- [https://github.com/markedjs/marked](https://github.com/markedjs/marked)
- [https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX)

## Related threats

- [marked Denial of Service via infinite recursion in tokenizer](https://junglewise.ai/threats/cve-2026-41680-marked-denial-of-service-via-infinite-recursion-in-tokenizer)
- [Marked Regular Expression Denial of Service (ReDoS)](https://junglewise.ai/threats/cve-2018-25110-marked-regular-expression-denial-of-service-redos)
- [marked ReDoS in block.def regular expression](https://junglewise.ai/threats/cve-2022-21680-marked-redos-in-block-def-regular-expression)
- [marked content injection in autolink](https://junglewise.ai/threats/marked-content-injection-in-autolink-0c735c59)
- [marked Regular Expression Denial of Service](https://junglewise.ai/threats/marked-regular-expression-denial-of-service-501371b1)