CVE-2026-41680
Last modified
CVE-2026-41680 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Marked Project | Marked | >= 18.0.0, < 18.0.2 |
References
- https://github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7Exploit, Vendor Advisory
- https://github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7Exploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-41680?
How severe is CVE-2026-41680?
How do I fix CVE-2026-41680?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-41675xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…8.7
- CVE-2026-41676rust-openssl provides OpenSSL bindings for the Rust programm…7.5
- CVE-2026-41677rust-openssl provides OpenSSL bindings for the Rust programm…9.1
- CVE-2026-41678rust-openssl provides OpenSSL bindings for the Rust programm…8.1
- CVE-2026-41679Paperclip is a Node.js server and React UI that orchestrates…10
- CVE-2026-4168A vulnerability was identified in Tecnick TCExam 16.5.0. Thi…2.4
- CVE-2026-41681rust-openssl provides OpenSSL bindings for the Rust programm…7.5
- CVE-2026-41682pupnp is an SDK for development of UPnP device and control p…6.9
- CVE-2026-41683i18next-http-middleware is a middleware to be used with Node…8.6
- CVE-2026-41684Incus is a system container and virtual machine manager. Pri…6.5
- CVE-2026-41685Incus is a system container and virtual machine manager. Pri…4.3
- CVE-2026-41686Claude SDK for TypeScript provides access to the Claude API …4.4
Are you affected by CVE-2026-41680?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST