CVE-2026-41680

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41680
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41680.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41680
Aliases
Downstream
Published
2026-04-24T17:26:27.847Z
Modified
2026-07-15T01:48:51.487434788Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer
Details

Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.

Database specific 
{
    "cwe_ids": [
        "CWE-400",
        "CWE-674",
        "CWE-835"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41680.json"
}
References

Affected packages

Git / github.com/markedjs/marked

Affected ranges

Type
GIT
Repo
https://github.com/markedjs/marked
Events
Introduced
28954e090f3814cff7c37de14352ddf2d9efebda
Fixed
c4f4529d69d254458831f3c22187d080db2f3c83
Database specific 
{
    "cpe": "cpe:2.3:a:marked_project:marked:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "18.0.0"
        },
        {
            "fixed": "18.0.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v18.*
v18.0.0
v18.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41680.json"