TI-2022-06057 Aliases CVE-2022-21681 GHSA-5v2h-r2cx-5xgj

Exponential catastrophic backtracking (ReDoS) in marked

HIGH 72CWE-1333Published 2022-01-14 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 1 fixed, 10 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.02893 86th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial marked (markedjs): 4.0.10marked (npm): 4.0.10Red Hat: 1 advisoryRed Hat: 1 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
markedjs	marked	before 4.0.10	4.0.10	Patch available	CNA
—	marked (npm)	before 4.0.10	4.0.10	Patch available	GHSA-5v2h-r2cx-5xgj

marked Vendormarkedjs Affected before 4.0.10 Fixed in 4.0.10 Patch available CNA
marked (npm) Vendor— Affected before 4.0.10 Fixed in 4.0.10 Patch available GHSA-5v2h-r2cx-5xgj

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:marked_project:marked::::::node.js::*	before 4.0.10	Vulnerable	markedjs
cpe:2.3:o:fedoraproject:fedora:36:::::::*	36	Vulnerable	Fedoraproject

cpe:2.3:a:marked_project:marked:*:*:*:*:*:node.js:*:* Versions before 4.0.10 Vulnerable ·markedjs
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject

Remediation

Fix · CNA marked (markedjs) Fixed in 4.0.10
Fix · GHSA-5v2h-r2cx-5xgj marked (npm) Fixed in 4.0.10 Advisory →

Red Hat 1 advisory

RHSA-2023:3642 Released 2023-06-15 · Red Hat rating Important
Red Hat Ceph Storage 6.1 Container security and bug fix update
- Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2022-01-14
markedjs marked — FEDORA-2022-784d729f30
2 records Highest priority Priority HIGH 2 HIGH
Other records, highest priority first
- TI-2022-06056 Cubic catastrophic backtracking (ReDoS) in markedPriority HIGH 72
Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Service Mesh 2.0	Affected	No fix yet
OpenShift Service Mesh 2.1	Affected	No fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix planned: Will not fix
Red Hat Ceph Storage 5	Affected	No fix yet
Red Hat Enterprise Linux 8	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 9	Affected	No fix planned: Will not fix
Red Hat Integration Data Virtualisation Operator	Affected	No fix planned: Out of support scope
Red Hat Integration Service Registry	Affected	No fix planned: Out of support scope
Red Hat JBoss Data Grid 7	Affected	No fix planned: Out of support scope
Red Hat OpenShift GitOps	Affected	No fix yet
Red Hat Ceph Storage 6.1 Tools	Fixed	RHSA-2023:3642

Not affected: 11 products

Red Hat Ceph Storage 5
Red Hat Ceph Storage 6.1 Tools
Red Hat Data Grid 8
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Fuse 7
Red Hat Integration Camel K 1
Red Hat JBoss Enterprise Application Platform 7
Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat Single Sign-On 7
Red Hat build of Apicurio Registry 2

Timeline

2026-10-02 Threatist record created from CVE-2022-21681
2026-10-03 Alias added: GHSA-5v2h-r2cx-5xgj

References

Exploit 1

https://github.com/markedjs/marked/security/advisories/GHSA-5v2h-r2cx-5xgj

Patch 1

https://github.com/markedjs/marked/commit/8f806573a3f6c6b7a39b8cdb66ab5ebb8d55a5f5

Advisory 2

Other 3

TI-2026-30197 Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer CVSS 4.0HIGH 8.7
TI-2022-06056 Cubic catastrophic backtracking (ReDoS) in marked CVSS 3.1HIGH 7.5
TI-2018-15336 Regular Expression Denial of Service (ReDoS) in markedjs/marked CVSS 4.0MEDIUM 6.9
TI-2015-07284 The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service… CVSS 3.1HIGH 7.5
TI-2021-04406 Denial of Service in Marked CVSS 3.1HIGH 7.5
TI-2017-11833 Uncontrolled resource consumption in HackerOne marked node module CVSS 3.0HIGH 7.5

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences