CVE-2026-41680: Marked Markdown Parser DoS Vulnerability

CVE-2026-41680 Overview

A critical Denial of Service (DoS) vulnerability has been identified in Marked, a popular markdown parser and compiler for Node.js applications. The vulnerability exists in versions 18.0.0 to 18.0.1 and allows an unauthenticated attacker to crash Node.js applications by providing a specially crafted 3-byte input sequence. This input triggers an infinite recursion loop during markdown parsing, leading to unbounded memory allocation and ultimately causing the host application to crash via Memory Exhaustion (OOM).

Critical Impact
Unauthenticated remote attackers can crash Node.js applications using Marked by sending a simple 3-byte payload, causing complete denial of service through memory exhaustion.

Affected Products

Marked versions 18.0.0 to 18.0.1
Node.js applications utilizing the affected Marked library versions
Web services and APIs that process user-supplied markdown content

Discovery Timeline

2026-04-24 - CVE-2026-41680 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41680

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and manifests as an algorithmic complexity attack within Marked's parsing engine. When the parser encounters a specific sequence of whitespace characters—a tab (\\x09), vertical tab (\\x0b), and newline (\\x0a)—it enters an infinite recursion loop. Each recursive call allocates additional memory without any termination condition being met, causing exponential memory growth until the Node.js process is killed by the operating system's OOM (Out-of-Memory) killer.

The network-accessible nature of this vulnerability makes it particularly dangerous for web applications that accept markdown input from users. An attacker requires no authentication or special privileges to exploit this flaw, and the attack can be executed with minimal effort using just three bytes of data.

Root Cause

The root cause lies in improper handling of whitespace character sequences during the tokenization phase of markdown parsing. The combination of horizontal and vertical whitespace characters creates a parsing state that the recursive descent parser cannot properly resolve, causing it to repeatedly call itself without advancing through the input or reaching a base case. This results in stack growth and heap allocation until system resources are exhausted.

Attack Vector

The attack vector is network-based and requires no user interaction. An attacker can exploit this vulnerability by:

Identifying a target application that uses Marked 18.0.0 or 18.0.1 for markdown processing
Submitting the malicious 3-byte sequence (\\x09\\x0b\\x0a) through any input field or API endpoint that processes markdown
The parsing operation triggers infinite recursion, consuming all available memory
The Node.js process crashes, denying service to legitimate users

The attack payload is trivially small, making it difficult to detect through size-based filtering and easy to deliver through various input channels including form fields, API requests, and websocket messages.

Detection Methods for CVE-2026-41680

Indicators of Compromise

Sudden memory spikes in Node.js applications processing markdown content
Application crashes with OOM (Out of Memory) errors
Presence of the byte sequence \\x09\\x0b\\x0a in application logs or request payloads
Repeated service restarts for markdown-processing services

Detection Strategies

Monitor Node.js process memory usage for abnormal growth patterns during markdown parsing operations
Implement input validation to detect and block the specific 3-byte sequence before it reaches the Marked parser
Configure application performance monitoring (APM) alerts for memory consumption thresholds
Review application dependencies to identify usage of vulnerable Marked versions (18.0.0 to 18.0.1)

Monitoring Recommendations

Set up memory usage alerts at 80% threshold for Node.js processes handling markdown parsing
Enable verbose logging for markdown parsing operations to capture suspicious input patterns
Implement request rate limiting on endpoints that accept markdown content
Monitor for unusual patterns of service restarts or container recreations

How to Mitigate CVE-2026-41680

Immediate Actions Required

Upgrade Marked to version 18.0.2 or later immediately across all affected applications
Audit all Node.js projects and dependencies to identify usage of vulnerable Marked versions
Implement input sanitization to strip or reject the malicious byte sequence as a temporary measure
Consider implementing parsing timeouts and memory limits for markdown processing operations

Patch Information

The vulnerability has been fixed in Marked version 18.0.2. Organizations should update their package dependencies immediately. The fix addresses the infinite recursion condition by properly handling the whitespace character sequence during tokenization. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

Implement input validation to reject markdown content containing the byte sequence \\x09\\x0b\\x0a before passing to Marked
Set memory limits on Node.js processes using the --max-old-space-size flag to prevent system-wide impact
Deploy markdown parsing in isolated worker processes or containers with resource constraints
Consider using alternative markdown parsers until the upgrade can be completed

bash

# Update Marked to the patched version
npm update marked@18.0.2

# Or specify the exact version in package.json
npm install marked@18.0.2 --save

# Set Node.js memory limits as a safeguard
node --max-old-space-size=512 app.js