CVE-2017-16114
Regular Expression Denial of Service in marked
CVE-2017-16114 is a high vulnerability (CVSS 7.5) in Marked Project Marked, published June 7, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.73%, the 77th percentile. Fixed in marked 0.3.9.
The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
- Record
CVE-2017-16114- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
- Record
CVE-2017-16114- Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2018-0342 No score
The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
- Record
EUVD-2018-0342- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x5pg-88wf-qq4p
Regular Expression Denial of Service in marked
Affected versions of marked are vulnerable to a regular expression denial of service.
The amplification in this vulnerability is significant, with 1,000 characters resulting in the event loop being blocked for around 6 seconds.
Recommendation
Update to version 0.3.9 or later.
- Record
GHSA-x5pg-88wf-qq4p- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
- Record
CVE-2017-16114- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-16114
The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
- Record
DEBIAN-CVE-2017-16114- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-x5pg-88wf-qq4p
Regular Expression Denial of Service in marked
Affected versions of marked are vulnerable to a regular expression denial of service.
The amplification in this vulnerability is significant, with 1,000 characters resulting in the event loop being blocked for around 6 seconds.
Recommendation
Update to version 0.3.9 or later.
- Record
GHSA-x5pg-88wf-qq4p- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-16114
The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
- Record
UBUNTU-CVE-2017-16114- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1773188128 No score
TuxCare security update for marked (8 CVEs)
TuxCare rebuilt marked to address 8 CVEs. Fixed in 0.2.10-tuxcare.1.
- Record
CLSA-2026-1773188128- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
markednpm |
before 0.3.9 | 0.3.9 |
markedTuxCare:npm |
0.2.10-tuxcare.0 up to 0.2.10-tuxcare.1, plus listed versions 0.2.10 |
0.2.10-tuxcare.1 |
node-markedDebian:12 |
before 0.3.9+dfsg-1 | 0.3.9+dfsg-1 |
node-markedDebian:13 |
before 0.3.9+dfsg-1 | 0.3.9+dfsg-1 |
node-markedDebian:14 |
before 0.3.9+dfsg-1 | 0.3.9+dfsg-1 |
node-markedUbuntu:16.04:LTS |
All versions, plus listed versions 0.3.2+dfsg-1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |