npmPackage

marked

11 known vulnerabilities (3 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release: 18.1.3 (Nov 2, 2026): no advisory affects it
Newest unaffected release: 18.1.3 (Nov 2, 2026), the latest release
Advisories: 11 · 3 high, 2 medium

Weekly downloads: 119.3M
Dependents: 4,857
Releases: 229 since 0.0.1 (Jul 24, 2011)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-41680
Affects 18.0.0 to 18.0.1 (18.0.2 is outside it)
CVE-2018-25110
Affects 0.0.1 to 0.3.16 (0.3.17 is outside it)
CVE-2022-21681
Affects 0.0.1 to 4.0.9 (4.0.10 is outside it)
CVE-2022-21680
Affects 0.0.1 to 4.0.9 (4.0.10 is outside it)
CVE-2021-21306
Affects 1.1.1 to 1.2.9 (2.0.0 is outside it)
CVE-2014-3743
Affects 0.0.1 to 0.3.0 (0.3.1 is outside it)
CVE-2017-16114
Affects 0.0.1 to 0.3.7 (0.3.9 is outside it)
CVE-2016-10531
Affects 0.0.1 to 0.3.5 (0.3.6 is outside it)
CVE-2017-1000427
Affects 0.0.1 to 0.3.6 (0.3.7 is outside it)
CVE-2015-8854
Affects 0.0.1 to 0.3.3 (0.3.4 is outside it)
CVE-2015-1370
Affects 0.0.1 to 0.3.2 (0.3.3 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 11

CVE-2026-41680High 8.7
Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer
Affected: from 18.0.0, fixed in 18.0.2.
Fixed in 18.0.2 (released Apr 18, 2026, 6 days before disclosure).
The latest release, 18.1.3, is not affected.
<0.1% of marked downloads last week were affected versions (82.7K).
CVE-2018-25110Medium 6.9
Regular Expression Denial of Service (ReDoS) in markedjs/marked
Affected: fixed in 0.3.17; fixed in 0.3.17.
Fixed in 0.3.17 (released Feb 27, 2018, 2642 days before disclosure).
The latest release, 18.1.3, is not affected.
0.1% of marked downloads last week were affected versions (145.5K).
CVE-2022-21681High 7.5
Exponential catastrophic backtracking (ReDoS) in marked
Affected: fixed in 4.0.10.
Fixed in 4.0.10 (released Jan 13, 2022, 1 day before disclosure).
The latest release, 18.1.3, is not affected.
2% of marked downloads last week were affected versions (2.7M).
CVE-2022-21680High 7.5
Cubic catastrophic backtracking (ReDoS) in marked
Affected: fixed in 4.0.10.
Fixed in 4.0.10 (released Jan 13, 2022, 1 day before disclosure).
The latest release, 18.1.3, is not affected.
2% of marked downloads last week were affected versions (2.7M).
CVE-2021-21306Medium 5.3
Denial of Service in Marked
Affected: from 1.1.1, fixed in 2.0.0.
Fixed in 2.0.0 (released Feb 7, 2021, 1 day before disclosure).
The latest release, 18.1.3, is not affected.
0.3% of marked downloads last week were affected versions (409.2K).
CVE-2014-3743Unrated
Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject…
Affected: fixed in 0.3.1.
Fixed in 0.3.1 (released Jan 31, 2014, 2166 days before disclosure).
The latest release, 18.1.3, is not affected.
<0.1% of marked downloads last week were affected versions (26.5K).
CVE-2017-16114Unrated
The marked module is vulnerable to a regular expression denial of service.
Affected: fixed in 0.3.9.
Fixed in 0.3.9 (released Dec 23, 2017, 166 days before disclosure).
The latest release, 18.1.3, is not affected.
<0.1% of marked downloads last week were affected versions (120.6K).
CVE-2016-10531Unrated
marked is an application that is meant to parse and compile markdown.
Affected: fixed in 0.3.6.
Fixed in 0.3.6 (released Jul 30, 2016, 670 days before disclosure).
The latest release, 18.1.3, is not affected.
<0.1% of marked downloads last week were affected versions (50K).
CVE-2017-1000427Unrated
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.
Affected: fixed in 0.3.7.
Fixed in 0.3.7 (released Dec 1, 2017, 32 days before disclosure).
The latest release, 18.1.3, is not affected.
<0.1% of marked downloads last week were affected versions (118.3K).
CVE-2015-8854Unrated
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that…
Affected: fixed in 0.3.4.
Fixed in 0.3.4 (released Jul 29, 2015, 544 days before disclosure).
The latest release, 18.1.3, is not affected.
<0.1% of marked downloads last week were affected versions (36.6K).
CVE-2015-1370Unrated
Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS)…
Affected: fixed in 0.3.3.
Fixed in 0.3.3 (released Jan 25, 2015, 2 days before disclosure).
The latest release, 18.1.3, is not affected.
<0.1% of marked downloads last week were affected versions (33.2K).