GitHub Advisoryadvisory · npm

GHSA-wx77-rp39-c6vg Regular Expression Denial of Service in markdown

LOW Published 2020-09-04 Modified 2022-03-24 Official page ↗
Ecosystem
npm
Packages
markdown
Severity
Low
Weaknesses
CWE-400
Reviewed
2020-08-31

Affected packages

• npm markdown: >= 0.0.0 (no fix yet)

Description

All versions of `markdown` are vulnerable to Regular Expression Denial of Service (ReDoS). The `markdown.toHTML()` function has significantly degraded performance when parsing long strings containing underscores. This may lead to Denial of Service if the parser accepts user input. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References