CVE-2026-41680

A flaw was found in marked, a markdown parser and compiler. An unauthenticated attacker can exploit this Denial of Service (DoS) vulnerability by providing a specific 3-byte input sequence (a tab, a vertical tab, and a newline). This input triggers an infinite recursion loop during parsing, leading to unbounded memory allocation and causing the host Node.js application to crash due to Memory Exhaustion (OOM).

This vulnerability is evaluated as having Moderate impact because the flaw is limited to a denial of service and does not compromise host confidentiality or integrity. Within Red Hat deployments, risk is confined to components and web interfaces that ingest untrusted Markdown content directly from users. While inducing the parsing recursion exhausts process memory and terminates the host runtime, an attacker cannot achieve remote code execution or elevate privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, Red Hat products that utilize the 'marked' library should be configured to process markdown content only from trusted sources. If markdown rendering is not a critical function, consider disabling or restricting its use within the application's configuration to reduce exposure.