Regular Expression Denial of Service Vulnerability in markdown-it by npm

CVE-2026-2327

What is CVE-2026-2327?

The markdown-it package, particularly versions from 13.0.0 and before 14.1.1, is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. This issue arises from the regex used in its linkify function: /+$. An attacker can exploit this vulnerability by providing a long string of asterisks () followed by a non-matching character. This causes excessive backtracking in the regex engine, potentially resulting in a denial-of-service condition that can interrupt the normal functioning of applications utilizing this package.

References