CVE-2015-8854: High severity Marked Project Marked Node.js vulnerability
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."
Other sources
Versions 0.3.3 and earlier of marked are affected by a regular expression denial of service ( ReDoS ) vulnerability when passed inputs that reach the em inline rule.
Recommendation
Update to version 0.3.4 or later.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8854?
CVE-2015-8854 is classified as a denial of service vulnerability due to its potential for CPU consumption.
How do I fix CVE-2015-8854?
To fix CVE-2015-8854, upgrade the marked package to version 0.3.4 or later.
Which versions are affected by CVE-2015-8854?
CVE-2015-8854 affects marked versions prior to 0.3.4 and Node.js versions up to 0.3.3.
What is a regular expression denial of service (ReDoS) in the context of CVE-2015-8854?
In the context of CVE-2015-8854, ReDoS refers to the vulnerability exploiting the catastrophic backtracking of a regex pattern, leading to excessive resource consumption.
Is CVE-2015-8854 related to Node.js or the marked package?
CVE-2015-8854 is specifically related to the marked package used in Node.js applications.