GitHub Advisoryadvisory · npm
GHSA-6vfc-qv3f-vr6c Uncontrolled Resource Consumption in markdown-it
MEDIUM
Official page ↗
- Aliases
- CVE-2022-21670
- Ecosystem
- npm
- Packages
- markdown-it
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-1333, CWE-400
- Reviewed
- 2022-01-10
Affected packages
• npm markdown-it: < 12.3.2 → fixed in 12.3.2
Description
Impact
Special patterns with length > 50K chars can slow down parser significantly.
```js
const md = require('markdown-it')();
md.render(`x ${' '.repeat(150000)} x \nx`);
```
Patches
Upgrade to v12.3.2+
Workarounds
No.
References
Fix + test sample: https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101
Related
Alias · CVE (1)
- CVE-2022-21670 markdown-it is a Markdown parser. vulnerability