Description
Showdownjs, versions <= 2.1.0, anchors subparser used to parse links has a nested regular expression which can lead to denial of service conditions given malicious input.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 2.1.0
References
Could your website be exposed too?
SmartScanner can check your website for Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing and gives you actionable findings to investigate.
Start a free scanRelated Issues
- es5-ext vulnerable to Regular Expression Denial of Service in `function#copy` and `function#toStringTokens` - CVE-2024-27088
- html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - CVE-2021-23346
- parse-uri Regular expression Denial of Service (ReDoS) - CVE-2024-36751
- parse-uri Regular expression Denial of Service (ReDoS) - parse-uri - CVE-2024-36751
You might also like:
See something that needs correcting? Let us knowUpdated April 24, 2026