GitHub Advisoryadvisory · npm

GHSA-38c4-r59v-3vqw markdown-it is has a Regular Expression Denial of Service (ReDoS)

MEDIUM Published 2026-02-12 Modified 2026-02-13 Official page ↗
Aliases
CVE-2026-2327
Ecosystem
npm
Packages
markdown-it
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-1333
Reviewed
2026-02-13

Affected packages

• npm markdown-it: >= 13.0.0, < 14.1.1 → fixed in 14.1.1

Description

Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.

Related

Alias · CVE (1)

  • CVE-2026-2327 Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References