CVE-2026-2327

Summary

Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.

Affected Software

VendorProductVersion RangeStatus
n/amarkdown-it13.0.0 < 14.1.1affected

Weaknesses

  • CWE-1333: Regular Expression Denial of Service (ReDoS)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: partial

Additional References

References