Описание
Marked ReDoS due to email addresses being evaluated in quadratic time
Versions of marked from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion.
Recommendation
Upgrade to version 0.6.2 or later.
Пакеты
Наименование
marked
npm
Затронутые версииВерсия исправления
>= 0.3.14, < 0.6.2
0.6.2
5.3 Medium
CVSS3
Дефекты
CWE-400
5.3 Medium
CVSS3
Дефекты
CWE-400