CVE-2026-2327
📋 TL;DR
This vulnerability allows attackers to cause a denial-of-service condition in markdown-it by exploiting a regular expression flaw. Attackers can send specially crafted input containing long sequences of asterisks followed by a non-matching character, causing excessive backtracking that consumes server resources. This affects any application using vulnerable versions of the markdown-it package to process user-controlled markdown content.
💻 Affected Systems
- markdown-it
📦 What is this software?
Markdown It by Markdown It Project
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, potentially affecting all users of the application.
Likely Case
Degraded performance or temporary service disruption for specific endpoints processing malicious input.
If Mitigated
Minimal impact with proper input validation, rate limiting, and updated dependencies.
🎯 Exploit Status
Exploit requires sending specially crafted input to endpoints that process markdown with linkify enabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.1.1
Vendor Advisory: https://github.com/markdown-it/markdown-it/commit/4b4bbcae5e0990a5b172378e507b33a59012ed26
Restart Required: No
Instructions:
1. Update package.json to require markdown-it@14.1.1 or higher. 2. Run npm update markdown-it or yarn upgrade markdown-it. 3. Test markdown processing functionality.
🔧 Temporary Workarounds
Disable linkify functionality
allPrevent exploitation by disabling the vulnerable linkify feature in markdown-it configuration.
const md = require('markdown-it')({ linkify: false });
Input length validation
allLimit input length to prevent long sequences that trigger the ReDoS.
// Add input validation before markdown processing
if (input.length > 10000) { reject('Input too long'); }
🧯 If You Can't Patch
- Implement strict input validation and sanitization for markdown content
- Deploy rate limiting and WAF rules to block suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check package.json or run npm list markdown-it to see if version is between 13.0.0 and 14.1.0 inclusive.Check Version:
npm list markdown-it | grep markdown-itVerify Fix Applied:
Confirm markdown-it version is 14.1.1 or higher using npm list markdown-it.📡 Detection & Monitoring
Log Indicators:
- Unusually high CPU usage on markdown processing endpoints
- Request timeouts on markdown-related API calls
Network Indicators:
- Multiple requests containing long sequences of asterisks (*)
- Pattern of requests to markdown processing endpoints
SIEM Query:
source="application_logs" AND (message:"markdown" OR endpoint:"/markdown") AND (cpu_usage>90 OR response_time>10s)🔗 References
- https://gist.github.com/ltduc147/c9abecae1b291ede4f692f2ab988c917
- https://github.com/markdown-it/markdown-it/blob/14.1.0/lib/rules_inline/linkify.mjs%23L33
- https://github.com/markdown-it/markdown-it/commit/4b4bbcae5e0990a5b172378e507b33a59012ed26
- https://security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-10666750
- https://gist.github.com/ltduc147/c9abecae1b291ede4f692f2ab988c917
- https://security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-10666750
