CVE-2015-8854: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 4.4% chance of exploitation in the next 30 days.

The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."

Affected products

• Fedoraproject Fedora: version 31 only; version 32 only
• Marked Project Marked: before 0.3.4 (fixed in 0.3.4)

Published 2017-01-23. Last modified 2026-06-17.