How Denial of Service via Specific Input Sequence happens in JavaScript (marked) and how to fix it

The Risk Hiding in Your Markdown Renderer

If your React frontend lets users write or submit Markdown—think comments, documentation editors, chat messages, or configuration notes—the library that parses that Markdown is directly in the path of untrusted input. In this application's frontend, marked is that library, and version 18.0.0 contains a high-severity Denial of Service vulnerability tracked as CVE-2026-41680.

The Trivy scanner flagged the vulnerable version pinned in frontend/package-lock.json, and an automated pull request was opened to upgrade to the patched release. This post explains exactly what the vulnerability is, how an attacker could exploit it, and what the two-file change does to close it.

The Vulnerability Explained

What Goes Wrong in marked 18.0.0

CVE-2026-41680 is a Denial of Service via specific input sequence in the marked Markdown parsing library. The root cause is a parsing path in marked 18.0.0 that, when fed a carefully constructed sequence of characters, enters a state of pathological processing—consuming CPU cycles or memory far beyond what any legitimate Markdown document would require.

This class of vulnerability is catalogued as CWE-400: Uncontrolled Resource Consumption. The parser does not adequately bound the resources it allocates or the work it performs when encountering the triggering input pattern.

The vulnerable declaration in frontend/package-lock.json (before the fix) was:

"node_modules/marked": {
  "version": "18.0.0",
  "resolved": "https://registry.npmjs.org/marked/-/marked-18.0.0.tgz",
  "integrity": "sha512-2e7Qiv/HJSXj8rDEpgTvGKsP8yYtI9xXHKDnrftrmnrJPaFNM7VRb2YCzWaX4BP1iCJ/XPduzDJZMFoqTCcIMA==",
  "bin": {
    "marked": "bin/marked.js"
  }
}

And in frontend/package.json:

"marked": "^18.0.0"

The ^18.0.0 semver range would allow npm to resolve a newer patch version—but because package-lock.json had 18.0.0 pinned with a specific integrity hash, the vulnerable version was locked in place and would not be updated without an explicit change.

How an Attacker Could Exploit This

Consider a frontend feature that accepts user-supplied Markdown—a comment field, a documentation editor, or a live-preview input box. The application passes that content directly to marked for rendering. An attacker does not need any special privileges; they only need to be able to submit input.

By sending a POST request with a body containing the specific input sequence that triggers the DoS condition:

POST /api/comments
Content-Type: application/json

{
  "body": "<crafted_sequence_triggering_CVE-2026-41680>"
}

The frontend's Markdown rendering pipeline—or any server-side use of the same marked dependency—begins processing the input and either:

1. Spins the event loop with a CPU-intensive parsing loop, blocking all other requests, or
2. Exhausts heap memory, causing the Node.js process to crash with an out-of-memory error.

In a single-threaded Node.js environment, either outcome effectively takes the entire frontend service offline for every user until the process is restarted. Because the trigger is an input sequence rather than a volume attack, this can be achieved with a single, small HTTP request—no botnet required.

The Fix

What Changed and Why Both Files Matter

The fix required changes to exactly two files: frontend/package.json and frontend/package-lock.json.

frontend/package.json — updating the version constraint:

-    "marked": "^18.0.0",
+    "marked": "^18.0.2",

This shifts the minimum acceptable version to 18.0.2, ensuring that any fresh npm install will not resolve to the vulnerable 18.0.0 or 18.0.1.

frontend/package-lock.json — pinning the patched release:

 "node_modules/marked": {
-  "version": "18.0.0",
-  "resolved": "https://registry.npmjs.org/marked/-/marked-18.0.0.tgz",
-  "integrity": "sha512-2e7Qiv/HJSXj8rDEpgTvGKsP8yYtI9xXHKDnrftrmnrJPaFNM7VRb2YCzWaX4BP1iCJ/XPduzDJZMFoqTCcIMA==",
+  "version": "18.0.2",
+  "resolved": "https://registry.npmjs.org/marked/-/marked-18.0.2.tgz",
+  "integrity": "sha512-NsmlUYBS/Zg57rgDWMYdnre6OTj4e+qq/JS2ot3KrYLSoHLw+sDu0Nm1ZGpRgYAq6c+b1ekaY5NzVchMCQnzcg==",
+  "license": "MIT",
   "bin": {
     "marked": "bin/marked.js"
   }
 }

The lock file update is critical. Without it, even if package.json specifies ^18.0.2, the lock file's pinned integrity hash for 18.0.0 would continue to be used in CI pipelines and production deployments that run npm ci (which respects the lock file exactly). Updating both files ensures that every environment—local development, CI, and production—installs the patched version.

The new integrity hash sha512-NsmlUYBS/... cryptographically verifies that the installed tarball is exactly marked@18.0.2 from the npm registry, preventing supply-chain substitution attacks.

What the Patch Does Inside marked

The 18.0.2 release tightens the parser's handling of the specific input sequences that trigger pathological processing. The fix introduces bounds on the internal parsing state so that the problematic input path terminates in bounded time rather than running indefinitely. Valid Markdown documents—headings, lists, code blocks, links, emphasis—are processed identically to before; only the malicious edge-case input is handled differently.

Key Takeaways

• package-lock.json must be updated alongside package.json: changing only the version range in package.json leaves the vulnerable version pinned in the lock file and deployed via npm ci.
• marked 18.0.0 is unsafe for any user-submitted Markdown: the DoS trigger requires no authentication and can be sent in a single small HTTP request, making exposure proportional to how widely the input field is accessible.
• Trivy's dependency scanning caught a pinned vulnerable version that semver range semantics alone would not have resolved—demonstrating why lock-file-aware scanners are necessary.
• Input length limits are a valuable complement to patching, not a replacement: they reduce the attack surface for any future parsing vulnerabilities in the same code path.
• The ^18.0.2 constraint ensures that future patch releases (e.g., 18.0.3) will be picked up automatically, while still preventing a downgrade to the vulnerable 18.0.0.

How Orbis AppSec Detected This

• Source: User-controlled Markdown content submitted through the frontend application's input fields
• Sink: The marked.parse() call consuming the untrusted input, resolved to marked@18.0.0 as pinned in frontend/package-lock.json
• Missing control: No version constraint or integrity check preventing the vulnerable 18.0.0 release from being installed; no runtime input bounding before the parse call
• CWE: CWE-400 — Uncontrolled Resource Consumption
• Fix: Upgraded marked from 18.0.0 to 18.0.2 in both frontend/package.json and frontend/package-lock.json, replacing the vulnerable integrity hash with the verified hash for the patched release

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

CVE-2026-41680 is a concrete reminder that Markdown parsers sit directly in the path of untrusted input and carry the same security obligations as any other input-processing component. The vulnerability in marked 18.0.0 required nothing more than a crafted string to take down a frontend service—no authentication, no elevated privileges, no volume.

The fix is a two-line version bump across two files, but the lesson is broader: lock files need to be treated as security-sensitive artifacts, dependency scanners need to run against them continuously, and any library that processes user input needs to be kept current. Upgrading to marked 18.0.2 closes this specific door; the practices above keep future doors from opening unnoticed.