Denial of Service in markdown-it-toc-and-anchor

Description

All versions of markdown-it-toc-and-anchor are vulnerable to Denial of Service. Parsing markdown containing **text**+\n@[toc] causes the application to enter and infinite loop.

Recommendation

Update the markdown-it-toc-and-anchor package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.2.0
• Patched version(s): 4.2.0

References

• GHSA-x6m6-5hrf-fh6r
• www.npmjs.com
• snyk.io
• CWE-400

Related Issues

• Regular Expression Denial of Service in markdown - Vulnerability
• Denial of Service in mem - Vulnerability
• Denial of Service in rgb2hex - Vulnerability
• Regular Expression Denial of Service in Acorn - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

markdown-it-toc-and-anchor