Vulnerability · Published Apr 24, 2026 · Assigned by GitHub_M

CVE-2026-41680Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer

High 8.7

In plain English

A high-severity uncontrolled resource consumption in marked from markedjs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 72.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	marked	18.0.2	GHSA-6v9c-7cg6-27q7

Affected products (as reported)

Vendor	Product	Versions
markedjs	marked	>= 18.0.0, < 18.0.2

Weakness: CWE-400, CWE-674, CWE-835 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7 x_refsource_CONFIRM