CVE-2018-25110 Regular Expression Denial of Service (ReDoS) in markedjs/marked

What is CVE-2018-25110?

CVE-2018-25110 is a medium-severity denial of service vulnerability in marked_project:marked, published on 23 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.

Weakness: CWE-1333

Which versions are affected by CVE-2018-25110?

2 open source packages ship an affected version, including marked. It affects 1 product.

Products include Marked Project Marked.

How do I fix CVE-2018-25110?

Upgrade marked to 0.3.17 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2018-25110 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-25110 exists.

Other vulnerabilities in marked_project:marked

• CVE-2026-41680 Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer High 8.7
• CVE-2017-16114 Regular Expression Denial of Service in marked High 7.5
• CVE-2014-3743 Multiple Content Injection Vulnerabilities in marked Medium 6.1
• CVE-2016-10531 Sanitization bypass using HTML Entities in marked Medium 6.1
• CVE-2017-1000427 Marked vulnerable to XSS from data URIs Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2018-25110, GHSA-p9wx-2529-fp83, UBUNTU-CVE-2018-25110.