Which versions of marked are affected by CVE-2026-41680?

CVE-2026-41680 affects marked, a widely-used Node.js markdown parsing library (versions 18.0.0-18.0.1), enabling unauthenticated attackers to crash applications through a 3-byte input sequence.. A patch is available.

Is there a public PoC exploit available for CVE-2026-41680?

Yes, a public proof-of-concept exploit is available for CVE-2026-41680. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-41680?

Within 24 hours: inventory all Node.js applications and dependencies using marked library; identify instances running versions 18.0.0 or 18.0.1. Within 7 days: upgrade marked to version 18.0.2 or later across all development, staging, and production environments; test markdown parsing functionality post-upgrade. Within 30 days: implement dependency scanning in CI/CD pipelines (e.g., npm audit, Snyk) to prevent future vulnerable marked versions from being deployed; document marked version pinning policy in dependency management standards.

marked CVE-2026-41680

Q: What is the CVSS score of CVE-2026-41680?

CVE-2026-41680 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25585 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-04-24 GitHub_M

GHSA-6v9c-7cg6-27q7

Node.js Denial Of Service Red Hat

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Red Hat

7.5 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 28, 2026 - 19:37 vuln.today

Public exploit code

Patch released

Apr 28, 2026 - 19:37 nvd

Patch available

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 24, 2026 - 20:15 vuln.today

Patch available

Apr 24, 2026 - 19:01 EUVD

CVSS changed

Apr 24, 2026 - 18:22 NVD

8.7 (HIGH)

EUVD ID Assigned

Apr 24, 2026 - 17:30 euvd

EUVD-2026-25585

Analysis Generated

Apr 24, 2026 - 17:30 vuln.today

CVE Published

Apr 24, 2026 - 17:26 nvd

HIGH 8.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

12 npm packages depend on marked (11 direct, 1 indirect)

Ecosystem-wide dependent count for version 18.0.0.

DescriptionGitHub Advisory

Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)-an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.

AnalysisAI

Unauthenticated remote attackers can crash Node.js applications using marked versions 18.0.0-18.0.1 by sending a specially crafted 3-byte sequence (tab, vertical tab, newline). The infinite recursion loop exhausts memory and triggers an out-of-memory crash, enabling complete denial of service against any exposed markdown parsing endpoint. Vendor-released patch fixes the vulnerability in version 18.0.2. No public exploit identified at time of analysis, though the attack input is trivially simple and reproducible. CVSS v4.0 8.7 reflects high availability impact with network reachability and no authentication barriers.

Technical ContextAI

The vulnerability exists in marked, a widely-used JavaScript markdown parser and compiler for Node.js environments (CPE: cpe:2.3:a:markedjs:marked). The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), specifically manifesting as infinite recursion during the parsing phase. When the parser encounters the byte sequence \x09\x0b\n (horizontal tab U+0009, vertical tab U+000B, line feed U+000A), the lexer or tokenizer enters an unbounded recursive call stack. Each recursion allocates additional memory without termination conditions, escalating until the Node.js runtime exhausts available heap space and triggers an OOM (out-of-memory) exception. This is a classic algorithmic complexity vulnerability where malformed input exploits inefficient state machine handling in the parser, causing O(∞) time and space complexity from a constant 3-byte input.

RemediationAI

Upgrade marked to version 18.0.2 immediately, as confirmed by the GitHub security advisory at https://github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7. For Node.js projects using npm, execute 'npm update marked' or explicitly set package.json dependency to '>=18.0.2'. For yarn users, run 'yarn upgrade marked'. If immediate upgrade is blocked by dependency conflicts, implement compensating controls: deploy input validation to reject markdown containing vertical tab characters (U+000B) before passing to the parser, accepting the trade-off of potentially rejecting legitimate edge-case content; configure Node.js memory limits via --max-old-space-size flag to contain blast radius, though this only converts crashes to controlled restarts; or isolate markdown parsing in separate worker processes with health monitoring and automatic restart policies to maintain service availability during attacks. All workarounds carry operational overhead and do not eliminate the vulnerability-patching to 18.0.2 remains the only complete remediation.