AIKIDO-2026-10452

TL;DR

Affected versions of marked are vulnerable to Regular Expression Denial of Service (ReDoS) due to catastrophic backtracking in the inline link and reference-link label regular expressions. The tokenizer regex used for parsing link labels contains nested alternatives combined with a lazy repetition, which can cause exponential backtracking when processing crafted markdown input (e.g., a [ followed by repeated multi-backtick sequences). This results in excessive CPU consumption and can cause the parser to hang or become unresponsive when handling untrusted markdown content.