CVE-2026-41680 Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer
An attacker can crash the host application by sending a specific 3-byte input that triggers infinite recursion and memory exhaustion in the marked parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41680?
CVE-2026-41680 is a high-severity denial of service vulnerability in markedjs marked, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.
Which versions are affected by CVE-2026-41680?
2 open source packages ship an affected version, including marked. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
marked npm | From 18.0.0 | 18.0.2 |
marked npm | From 18.0.0 | 18.0.2 |
Products include Marked Project Marked.
How do I fix CVE-2026-41680?
Upgrade marked to 18.0.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-41680 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41680 exists.
Other vulnerabilities in markedjs marked
- CVE-2017-16114 Regular Expression Denial of Service in marked
- CVE-2018-25110 Regular Expression Denial of Service (ReDoS) in markedjs/marked
- CVE-2014-3743 Multiple Content Injection Vulnerabilities in marked
- CVE-2016-10531 Sanitization bypass using HTML Entities in marked
- CVE-2017-1000427 Marked vulnerable to XSS from data URIs
Sources
Also known as CLSA-2026-1792775729, GHSA-6v9c-7cg6-27q7, MINI-4h6w-gpx3-5jw6.