CVE-2026-41680: marked Denial of Service via infinite recursion in tokenizer

CVE-2026-41680 · Severity: high · CVSS 7.5 · Published 2026-04-24

Marked is a popular JavaScript library used to parse and render Markdown content in web applications and documentation systems. A vulnerability in versions 18.0.0–18.0.1 allows an unauthenticated attacker to crash any application using the library by sending just 3 bytes of malformed input, causing the application to run out of memory and stop serving users. This is a complete denial of service with no authentication required and trivial resource cost to the attacker.

Technologies: Marked Project Marked, marked (npm). Vendors: Marked Project, npm.

Quick answers

Is CVE-2026-41680 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41680 being exploited in the wild.
How severe is CVE-2026-41680?
High severity, with a CVSS score of 7.5, published 24 April 2026.
Which products and versions are affected?
marked (npm) SEMVER:introduced=18.0.0,fixed=18.0.2.
Is there a fix for CVE-2026-41680?
Yes. marked (npm): upgrade to 18.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41680 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41680?
Check whether you run Marked Project Marked or marked (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • marked (npm): upgrade to 18.0.2 or later
    npm install marked@18.0.2

Technical details

The vulnerability is an infinite recursion bug in marked's block and inline tokenizers triggered by a specific whitespace sequence: tab (0x09), vertical tab (0x0b), and newline (0x0a). The tab character is consumed by the space() tokenizer, leaving the vertical tab and newline. The vertical tab is not accounted for in standard whitespace rules, causing the parser to fall through to the text tokenizer, which then recursively calls inlineTokens() on the same unprocessed content, entering an infinite loop. Each recursion allocates new token objects and strings, exhausting heap memory until the Node.js process crashes with an out-of-memory error. The attack requires no authentication, network access only, and crashes the target application with minimal resources. A fix is available in marked version 18.0.2.

Affected products

  • markedjs marked 18.0.0, 18.0.1

Identifiers

  • CVE-2026-41680
  • GHSA-6v9c-7cg6-27q7

Timeline

  • 2026-04-29: disclosed: Advisory GHSA-6v9c-7cg6-27q7 published
  • 2026-04-29: patched: Fix released in version 18.0.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.