https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T12:58:52.551252+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2015-8854 CVE-2015-8854 2026-09-30T12:58:52.554528+00:00

The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."

 https://vulnerability.circl.lu/vuln/ghsa-hjcp-j389-59ff GHSA-hjcp-j389-59ff — Regular Expression Denial of Service in marked 2026-09-30T12:58:52.554839+00:00

Affected: npm: marked

Versions 0.3.3 and earlier of `marked` are affected by a regular expression denial of service ( ReDoS ) vulnerability when passed inputs that reach the `em` inline rule.

## Recommendation

Update to version 0.3.4 or later.