Vulnerability Description
Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Marked Project | Marked | >= 18.0.0, < 18.0.2 |
Related Weaknesses (CWE)
References
- https://github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7ExploitVendor Advisory
- https://github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7ExploitVendor Advisory
FAQ
What is CVE-2026-41680?
CVE-2026-41680 is a vulnerability with a CVSS score of 7.5 (HIGH). Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab,...
How severe is CVE-2026-41680?
CVE-2026-41680 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41680?
Check the references section above for vendor advisories and patch information. Affected products include: Marked Project Marked.