Executive brief
Marked is a popular JavaScript library used to parse and render Markdown content in web applications and documentation systems. A vulnerability in versions 18.0.0–18.0.1 allows an unauthenticated attacker to crash any application using the library by sending just 3 bytes of malformed input, causing the application to run out of memory and stop serving users. This is a complete denial of service with no authentication required and trivial resource cost to the attacker.
Technical details
The vulnerability is an infinite recursion bug in marked's block and inline tokenizers triggered by a specific whitespace sequence: tab (0x09), vertical tab (0x0b), and newline (0x0a). The tab character is consumed by the space() tokenizer, leaving the vertical tab and newline. The vertical tab is not accounted for in standard whitespace rules, causing the parser to fall through to the text tokenizer, which then recursively calls inlineTokens() on the same unprocessed content, entering an infinite loop. Each recursion allocates new token objects and strings, exhausting heap memory until the Node.js process crashes with an out-of-memory error. The attack requires no authentication, network access only, and crashes the target application with minimal resources. A fix is available in marked version 18.0.2.
Affected products
- markedjs marked 18.0.0, 18.0.1
Timeline
- 2026-04-29: disclosed: Advisory GHSA-6v9c-7cg6-27q7 published
- 2026-04-29: patched: Fix released in version 18.0.2