CVE-2026-41680: Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-24 · updated 2026-10-26
Weakness: CWE-400

Description

Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.

Affected products

markedjs marked: from 18.0.0 before 18.0.2 — fixed in 18.0.2

How to fix

Upgrade to a fixed version: markedjs marked 18.0.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-41680 or the next vulnerability affects your stack