GHSA-6v9c-7cg6-27q7

El texto en lenguaje claro solo aparece si ya está en caché. Esta página no lo genera.

Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer

### Summary A critical Denial of Service (DoS) vulnerability exists in `[email protected]`. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (`\x09\x0b\n`)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). ### Details The vulnerability originates in how `marked`'s block tokenizer handles unexpected whitespace characters. 1. **Tab Character (`\x09`) Consumption**: The `space()` tokenizer matches standard whitespace using the regex `/^(?:[ \t]*(?:\n|$))+/`. When parsing the malicious payload (`\x09\x0b\n`), thi…