Read the docs
TI-2026-30197 Aliases CVE-2026-41680GHSA-6v9c-7cg6-27q7

Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer

Priority HIGH 77CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 9 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00342 27th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial marked (markedjs): 18.0.2marked (npm): 18.0.2Red Hat: 3 advisoriesRed Hat: 2 fixed, 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
markedjsmarked18.0.0 to before 18.0.218.0.2Patch availableCNA
—marked (npm)18.0.0 to before 18.0.218.0.2Patch availableGHSA-6v9c-7cg6-27q7
  • marked Vendormarkedjs Affected 18.0.0 to before 18.0.2 Fixed in 18.0.2 Patch available CNA
  • marked (npm) Vendor— Affected 18.0.0 to before 18.0.2 Fixed in 18.0.2 Patch available GHSA-6v9c-7cg6-27q7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:marked_project:marked:*:*:*:*:*:node.js:*:*18.0.0 to before 18.0.2Vulnerablemarkedjs
  • cpe:2.3:a:marked_project:marked:*:*:*:*:*:node.js:*:* Versions 18.0.0 to before 18.0.2 Vulnerable ·markedjs

Remediation

  • Fix · CNA marked (markedjs) Fixed in 18.0.2
  • Fix · GHSA-6v9c-7cg6-27q7 marked (npm) Fixed in 18.0.2 Advisory →

Red Hat 3 advisories

  • RHSA-2026:79243 Released 2026-10-08 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:26225 Released 2026-06-16 · Red Hat rating Important
    Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
  • RHSA-2026:26214 Released 2026-06-16 · Red Hat rating Important
    General availability of the satellite/iop-advisor-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-advisor-frontend-rhel9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Build of Podman Desktop - Tech PreviewAffectedNo fix planned: Will not fix
Red Hat Ceph Storage 9AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 2AffectedNo fix planned: Will not fix
Self-service automation portal 2AffectedNo fix yet
Red Hat Ceph Storage 8.1Fixed RHSA-2026:79243
Red Hat Satellite 6.18Fixed RHSA-2026:26214, RHSA-2026:26225
Not affected: 21 products
  • Migration Toolkit for Virtualization
  • Multicluster Engine for Kubernetes
  • OpenShift Lightspeed
  • OpenShift Service Mesh 3
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ceph Storage 8.1
  • Red Hat Data Grid 8
  • Red Hat Developer Hub 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat build of Apicurio Registry 3
  • streams for Apache Kafka 2
  • streams for Apache Kafka 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41680
  2. 2026-10-03 Alias added: GHSA-6v9c-7cg6-27q7
  3. 2026-10-09 Fix available: RHSA-2026:79243 · Red Hat
  4. 2026-10-09 Fix available: Red Hat Ceph Storage 8.1 · Red Hat
  5. 2026-10-27 Affected versions changed · Red Hat

References

Exploit 1

Advisory 1

Other 1

  • TI-2022-06057 Exponential catastrophic backtracking (ReDoS) in marked CVSS 3.1HIGH 7.5
  • TI-2022-06056 Cubic catastrophic backtracking (ReDoS) in marked CVSS 3.1HIGH 7.5
  • TI-2018-15336 Regular Expression Denial of Service (ReDoS) in markedjs/marked CVSS 4.0MEDIUM 6.9
  • TI-2015-07284 The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service… CVSS 3.1HIGH 7.5
  • TI-2021-04406 Denial of Service in Marked CVSS 3.1HIGH 7.5
  • TI-2017-11833 Uncontrolled resource consumption in HackerOne marked node module CVSS 3.0HIGH 7.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences