Marked vulnerabilitiesMarked: known vulnerabilities and safe versions
npm: marked
Marked has 13 known vulnerability records: 11 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses) and 2 only in Retire.js (CDN builds and advisories without a CVE).
By branch: 18.x is safe from 18.0.2; 4.x is safe from 4.0.10; 2.x has no fixed release in the records; 1.x has no fixed release in the records.
Vulnerabilities and safe version by branch
Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.
| Branch | Support | Latest on branch | Records | Safe version |
|---|---|---|---|---|
| 18.x | — | — | 1high | 18.0.2 |
| 4.x | — | — | 2high | 4.0.10 |
| 2.x | — | — | 2high | No fix |
| 1.x | — | — | 3high | No fix |
| 0.7.x | — | — | 2high | No fix |
| 0.6.x | — | — | 4high | No fix |
| 0.4.x | — | — | 4high | No fix |
| 0.3.x | — | — | 10high | No fix |
Support dates appear only for libraries that endoflife.date tracks.
Records
Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.
CVE-2026-416802026-04-24
Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer
Affected versions: >= 18.0.0, < 18.0.2
high 8.7
Fixed in: 18.0.2
CVE-2018-251102025-05-23
Regular Expression Denial of Service (ReDoS) in markedjs/marked
Affected versions: < 0.3.17
medium 6.9
Fixed in: 0.3.17
CVE-2022-216812022-01-14
Exponential catastrophic backtracking (ReDoS) in marked
Affected versions: < 4.0.10
high 7.5
Fixed in: 4.0.10
EPSS 2.7%
CVE-2022-216802022-01-14
Cubic catastrophic backtracking (ReDoS) in marked
Affected versions: < 4.0.10
high 7.5
Fixed in: 4.0.10
EPSS 2.8%
high 7.5
Fixed in: 2.0.0
EPSS 2.4%
CVE-2014-37432020-01-06
Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary
Affected versions: < 0.3.1
medium 6.1
Fixed in: 0.3.1
EPSS 1.7%
CVE-2017-161142018-06-06
The marked module is vulnerable to a regular expression denial of service.
Affected versions: < 0.3.9
high 7.5
Fixed in: 0.3.9
EPSS 1.7%
CVE-2016-105312018-05-31
marked is an application that is meant to parse and compile markdown.
Affected versions: < 0.3.6
medium 6.1
Fixed in: 0.3.6
EPSS 1.4%
CVE-2017-10004272018-01-02
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.
Affected versions: < 0.3.7
medium 6.1
Fixed in: 0.3.7
EPSS 1.5%
CVE-2015-88542017-01-23
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that tri
Affected versions: < 0.3.4
high 7.5
Fixed in: 0.3.4
EPSS 4.4%
CVE-2015-13702015-01-27
Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) att
Affected versions: < 0.3.3
medium 4.3
Fixed in: 0.3.3
EPSS 2%
Marked versions 0.3.14 through 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) in email address parsing. Email addresses embedded in Markdown may be evaluated in quadratic time, potentially crashing the Node.js process
Affected versions: >= 0.3.14, < 0.6.2
medium
Fixed in: 0.6.2
Affected versions of marked are vulnerable to Regular Expression Denial of Service (ReDoS) via the _label subrule. Malformed input can significantly degrade parsing performance, blocking the event loop.
Affected versions: >= 0.4.0, < 0.7.0
low
Fixed in: 0.7.0
Sources and method
Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.
This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.
Data as of October 22, 2026.