CVE-2015-8854: The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption)...

Security readout for executives and security teams

CVE-2015-8854 is a denial-of-service flaw in the Node.js marked Markdown package before 0.3.4. Malicious input can make a regular expression consume excessive CPU, potentially slowing or freezing services that parse untrusted Markdown. Exposure is most likely in Node.js applications that depend on marked before 0.3.4 and process user-supplied or externally sourced Markdown. The bundle does not identify precise downstream affected products. Treat as a targeted availability risk, not a confirmed breach indicator. Prioritize internet-facing or business-critical systems that accept Markdown content and still run old Node.js dependencies. Mitigation focus: Identify applications and packages using marked before 0.3.4.; Upgrade marked to 0.3.4 or a later vendor-supported version.; Check downstream vendor advisories for packaged or embedded copies..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.