GitHub Advisoryadvisory · npm
GHSA-wx77-rp39-c6vg Regular Expression Denial of Service in markdown
LOW
Official page ↗
- Ecosystem
- npm
- Packages
- markdown
- Severity
- Low
- Weaknesses
- CWE-400
- Reviewed
- 2020-08-31
Affected packages
• npm markdown: >= 0.0.0 (no fix yet)
Description
All versions of `markdown` are vulnerable to Regular Expression Denial of Service (ReDoS). The `markdown.toHTML()` function has significantly degraded performance when parsing long strings containing underscores. This may lead to Denial of Service if the parser accepts user input.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
Related
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness