CVE-2022-21680 Overview
CVE-2022-21680 is a regular expression denial of service (ReDoS) vulnerability in Marked, a widely used JavaScript markdown parser and compiler. The flaw resides in the block.def regular expression, which exhibits catastrophic backtracking when processing specially crafted input strings. Applications that pass untrusted markdown through Marked without isolating parsing in a time-limited worker thread are exposed to resource exhaustion. The issue affects all versions prior to 4.0.10 and is tracked under [CWE-1333] and [CWE-400]. Successful exploitation drains CPU resources and can render dependent services unresponsive.
Critical Impact
An attacker can submit a small markdown payload that forces the regex engine into exponential backtracking, exhausting CPU and causing application-level denial of service.
Affected Products
- Marked (marked_project) versions prior to 4.0.10 on Node.js
- Fedora 36
- Any web application or service embedding a vulnerable Marked release
Discovery Timeline
- 2022-01-14 - CVE-2022-21680 published to the National Vulnerability Database
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2022-21680
Vulnerability Analysis
Marked converts markdown source text into HTML using a chain of regular expressions that tokenize block-level and inline constructs. The block.def regular expression matches link reference definitions, such as [label]: url "title". The pattern contains overlapping quantifiers that allow multiple ways to match the same substring. When the engine encounters input that nearly matches but ultimately fails, it explores every possible permutation before declaring failure. This pathological behavior is the defining characteristic of catastrophic backtracking.
The single-threaded nature of Node.js compounds the impact. While the regex engine spins, the event loop is blocked and the process cannot service other requests. A single malicious markdown document can stall an entire server instance.
Root Cause
The root cause is an ambiguous regular expression in the block-level link reference definition matcher. Quantified groups inside block.def can match the same characters along multiple paths, producing exponential time complexity relative to input length. The Marked maintainers addressed the issue in commit c4a3ccd344b6929afa8a1d50ac54a721e57012c0, which rewrites the expression to remove the ambiguity. See the GitHub Security Advisory GHSA-rrrm-qjm4-v8hf for technical details.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. Any feature that renders user-supplied markdown — comment systems, wiki pages, chat clients, documentation portals, README previews — provides a delivery channel. An attacker submits a crafted markdown string that triggers the vulnerable block.def regex. The Marked process consumes CPU until the regex times out or the request handler is terminated, denying service to legitimate users.
No public proof-of-concept code is referenced in the advisory. Technical specifics are documented in the GitHub Release Note v4.0.10 and the patch commit.
Detection Methods for CVE-2022-21680
Indicators of Compromise
- Sustained 100% CPU utilization on a single Node.js worker correlated with an inbound HTTP request carrying markdown content
- Request handlers hanging on calls into the marked module without returning, eventually triggering upstream timeouts
- Markdown payloads containing long runs of bracket, parenthesis, or whitespace characters resembling malformed link reference definitions
Detection Strategies
- Inventory application dependencies and flag any installation of marked at a version below 4.0.10 using package manifests or software composition analysis tools
- Instrument markdown rendering paths to record per-request CPU time and emit alerts when parsing exceeds a defined threshold
- Correlate Node.js event loop lag metrics with inbound request logs to identify abusive markdown submissions
Monitoring Recommendations
- Forward web server access logs and application performance metrics into a centralized analytics platform to detect repeated long-running render requests from the same source
- Track process-level CPU spikes on rendering services and alert when a single request consumes disproportionate compute time
- Monitor dependency manifests in CI pipelines to fail builds that pin vulnerable marked versions
How to Mitigate CVE-2022-21680
Immediate Actions Required
- Upgrade marked to version 4.0.10 or later across all production and development environments
- Apply the Fedora 36 package update referenced in the Fedora Package Announcement
- Audit application code paths that feed user-controlled content into marked and confirm input length and rate limits are enforced
Patch Information
The vulnerability is fixed in Marked 4.0.10. The corrective change is contained in commit c4a3ccd344b6929afa8a1d50ac54a721e57012c0, which removes ambiguous quantifiers from the block.def regular expression. Release details are available in the GitHub Release Note v4.0.10.
Workarounds
- Run Marked inside a worker thread and enforce a strict execution time limit so a single malicious document cannot stall the main event loop
- Reject or sanitize markdown input that exceeds reasonable size limits before invoking the parser
- Avoid processing untrusted markdown until the upgrade to 4.0.10 or later is completed
# Upgrade marked to a patched version using npm
npm install marked@^4.0.10
# Verify the installed version
npm ls marked
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
