{"id":"CVE-2026-41680","revision":null,"records":[{"revision":"a76c8aef36be44a0b65d28e457e5e7ef","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-41680","aliases":[],"title":"Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer","description":"Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\\x09\\x0b\\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.","state":0,"publishedAt":"2026-04-24T17:26:27.847+00:00","modifiedAt":"2026-04-24T19:08:41.3+00:00","affected":[{"ecosystem":"Vendor product","name":"marked","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"markedjs\",\n                    \"product\": \"marked\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 18.0.0, < 18.0.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"}],"references":["https://github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-41680","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-41680","identifiers":["CVE-2026-41680"]},"retained":false,"historicalAffected":[]},{"revision":"62fb2b748f4a4a4abbd03247eda7635c","observedAt":"2026-10-28T05:10:49.017+00:00","statement":{"source":"euvd","id":"EUVD-2026-25585","aliases":["CVE-2026-41680"],"title":"Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\\x09\\x0b\\n)—an unauthent…","description":"Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\\x09\\x0b\\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25585","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 24, 2026, 5:26:27 PM","dateUpdated":"Apr 24, 2026, 7:08:41 PM"},"relatedAdvisories":[{"id":"RHSA-2026:26225","title":"Red Hat Security Advisory: Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image","vulnerabilityIds":["CVE-2026-6322","CVE-2026-9277","CVE-2026-26996","CVE-2026-27904","CVE-2026-29063","CVE-2026-41680","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:79243","title":"Red Hat Security Advisory: Red Hat Ceph Storage","vulnerabilityIds":["CVE-2021-43565","CVE-2022-27191","CVE-2023-48795","CVE-2024-48916","CVE-2025-30156","CVE-2026-21721","CVE-2026-39944","CVE-2026-41680","CVE-2026-50152","CVE-2026-54330"]},{"id":"RHSA-2026:26214","title":"Red Hat Security Advisory: General availability of the satellite/iop-advisor-frontend-rhel9 container image","vulnerabilityIds":["CVE-2025-69873","CVE-2026-6321","CVE-2026-26996","CVE-2026-27904","CVE-2026-41680","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-25585","identifiers":["EUVD-2026-25585","CVE-2026-41680"]},"retained":false,"historicalAffected":[]},{"revision":"f94ab6870ddf4549a75739094d371cf3","observedAt":"2026-10-27T10:10:19.004+00:00","statement":{"source":"nvd","id":"CVE-2026-41680","aliases":[],"title":"Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\\x09\\x0b\\n)—an unauthent…","description":"Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\\x09\\x0b\\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.","state":0,"publishedAt":"2026-04-24T18:16:29.567+00:00","modifiedAt":"2026-10-26T21:10:00.17+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41680","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-400","CWE-674","CWE-835"],"productCriteria":["cpe:2.3:a:marked_project:marked:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-04-24T18:16:29.567","lastModified":"2026-10-26T21:10:00.170"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-41680","identifiers":["CVE-2026-41680"]},"retained":false,"historicalAffected":[]},{"revision":"993eb888fb774389a9c04aa3b2135278","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-6v9c-7cg6-27q7","aliases":["CVE-2026-41680"],"title":"Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer","description":"### Summary\nA critical Denial of Service (DoS) vulnerability exists in `marked@18.0.0`. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (`\\x09\\x0b\\n`)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). \n\n### Details\nThe vulnerability originates in how `marked`'s block tokenizer handles unexpected whitespace characters. \n\n1. **Tab Character (`\\x09`) Consumption**: The `space()` tokenizer matches standard whitespace using the regex `/^(?:[ \\t]*(?:\\n|$))+/`. When parsing the malicious payload (`\\x09\\x0b\\n`), this rule successfully consumes the initial tab character (`\\x09`).\n2. **Vertical Tab (`\\x0b`) Bypass**: The remaining input is now `\\x0b\\n`. The newline block rule explicitly looks for spaces or standard tabs (`[ \\t]`) followed by a newline. Because the vertical tab is a legacy ASCII character not accounted for in this rule, it fails to match.\n3. **Fallback to Text Tokenizer**: None of the standard block tokenizers (blockquote, code, heading, etc.) match `\\x0b\\n`. As a result, the parser falls through to the `text` tokenizer (`/^[^\\n]+/`), which matches any character except a newline.\n4. **Infinite Recursion**: Inside `blockTokens()`, the `text` tokenizer creates a text token and subsequently calls `inlineTokens()` on the exact same content. Inside `inlineTokens()`, the text rule again matches `\\x0b\\n` and recursively calls `inlineTokens()`. This creates an inescapable cycle: `blockTokens() → text token → inlineTokens() → text rule matches → inlineTokens() → ...`\n\nWith each recursive call allocating new token objects and concatenating strings, memory grows indefinitely until the Node.js heap limit is reached.\n\n**Vulnerable Code in `lib/marked.esm.js` (Lexer class, `blockTokens()`):**\n```javascript\n// The text tokenizer triggers infinite recursion\nif(r=this.tokenizer.text(e)) {\n    e=e.substring(r.raw.length);\n    let s=t.at(-1);\n    s?.type===\"text\"?(s.raw+=(s.raw.endsWith(\"\\n\")?\"\":\"\\n\")+r.raw, s.text+=\"\\n\"+r.text, this.inlineQueue.pop(), this.inlineQueue.at(-1).src=s.text):t.push(r);\n    // ↑ This calls inlineTokens() internally via the text tokenizer, causing the OOM loop\n    continue;\n}\n```\n\n### PoC\nThis vulnerability can be reproduced using any standard Node.js environment with `marked@18.0.0` installed.\n\n1. Create a file named `poc.js` with the following content:\n```javascript\nconst marked = require('marked');\n\n// The vulnerable 3-byte pattern: tab + vertical tab + newline\nconst vulnerableInput = '\\x09\\x0b\\n';\n\nconsole.log('Attempting to parse malicious payload...');\ntry {\n    marked.parse(vulnerableInput);\n} catch(e) {\n    console.log('Error:', e.message);\n}\n```\n2. Run the script: `node poc.js`\n3. **Result:** The process will hang briefly as memory spikes, ultimately crashing with: `FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`.\n\n### Impact\nThis is a High-Severity Denial of Service (DoS) vulnerability via Memory Exhaustion. \n\n**Impacted Parties:** Any application, API, chatbot, or documentation system using `marked@18.0.0` (and potentially earlier versions) to parse untrusted user input is vulnerable. \n\nBecause the payload requires zero authentication and only 3 bytes of data, it requires virtually no resources from the attacker to remotely crash the service and achieve a total loss of availability for the targeted application.","state":0,"publishedAt":"2026-04-29T22:12:20+00:00","modifiedAt":"2026-05-05T16:11:33.907963+00:00","affected":[{"ecosystem":"npm","name":"marked","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"18.0.0"},{"kind":"fixed","version":"18.0.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7","https://nvd.nist.gov/vuln/detail/CVE-2026-41680","https://github.com/markedjs/marked"],"sourceUrl":"https://github.com/advisories/GHSA-6v9c-7cg6-27q7","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-6v9c-7cg6-27q7","identifiers":["GHSA-6v9c-7cg6-27q7","CVE-2026-41680"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-30T01:48:55.4491357+00:00","complete":true,"records":1764,"lastAttemptAt":"2026-10-30T01:48:55.4491357+00:00","lastSuccessAt":"2026-10-30T01:48:55.6546169+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.6546176+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7e2c4e7288f2c464ad8c61f3bb6017374714faedcc781283ac06a706ee1a820b-8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85","complete":true,"records":416807,"lastAttemptAt":"2026-10-30T01:48:54.7743429+00:00","lastSuccessAt":"2026-10-30T00:54:38.6858592+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:54.7743429+00:00","snapshotPublishedAt":"2026-10-30T01:29:33+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-824f5092797940c08129032fcab8f0dd","complete":false,"records":13504,"lastAttemptAt":"2026-10-30T02:01:05.0861472+00:00","lastSuccessAt":"2026-10-30T02:01:05.08+00:00","error":"9 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-10-30T02:01:05.08+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13547,"expectedIdentifiers":13587,"failedIdentifiers":9},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-30T01:48:55.4491357+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-30T01:48:55.4491357+00:00","lastSuccessAt":"2026-10-30T01:48:55.6554576+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.6554578+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c39f89b50d5243318487ad216daf7ffb","complete":true,"records":13527,"lastAttemptAt":"2026-10-30T01:48:56.2261206+00:00","lastSuccessAt":"2026-10-29T22:50:37.74+00:00","error":null,"lastVerifiedAt":"2026-10-29T22:50:37.74+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13587,"expectedIdentifiers":13587,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-9016081e9e88f5929902343d85df87c5c4a1486b10ab07bc6c4f53f98f358871","complete":true,"records":9806,"lastAttemptAt":"2026-10-30T01:48:55.2317852+00:00","lastSuccessAt":"2026-10-29T17:17:25.9359141+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.2317852+00:00","snapshotPublishedAt":"2026-10-29T16:48:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-30T01:48:54.9356382+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:54.9356382+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-5221f6b645588be0464ab0e16e8adfe42d1ccd8f841048d2bd4d0c1cf79fd6b1","complete":true,"records":3014,"lastAttemptAt":"2026-10-30T01:48:55.4168216+00:00","lastSuccessAt":"2026-10-30T00:54:54.6624163+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.4168216+00:00","snapshotPublishedAt":"2026-10-30T00:48:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ec5b13e78c39945726a720832da7660d2774969f16e2a34f99460c135811abd5","complete":true,"records":230948,"lastAttemptAt":"2026-10-30T01:48:55.0481567+00:00","lastSuccessAt":"2026-10-29T22:50:35.0693267+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.0481567+00:00","snapshotPublishedAt":"2026-10-29T22:33:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}