Description
All versions of markdown are vulnerable to Regular Expression Denial of Service (ReDoS). The markdown.toHTML() function has significantly degraded performance when parsing long strings containing underscores. This may lead to Denial of Service if the parser accepts user input.
Recommendation
No fix is available yet. Followings are affected versions:
- >= 0.0.0
References
Related Issues
- Regular Expression Denial of Service in Acorn - Vulnerability
- tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability - CVE-2026-22809
- Regular Expression Denial of Service in clean-css - Vulnerability
- Regular Expression Denial of Service in marked - marked - GHSA-ch52-vgq2-943f - Vulnerability
You might also like:
- Tags:
- npm
- markdown
Anything's wrong? Let us know Last updated on January 09, 2023