CVE-2026-2327: markdown-it is has a Regular Expression Denial of Service (ReDoS)
(updated )
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.
References
- gist.github.com/ltduc147/c9abecae1b291ede4f692f2ab988c917
- github.com/advisories/GHSA-38c4-r59v-3vqw
- github.com/markdown-it/markdown-it
- github.com/markdown-it/markdown-it/blob/14.1.0/lib/rules_inline/linkify.mjs
- github.com/markdown-it/markdown-it/commit/4b4bbcae5e0990a5b172378e507b33a59012ed26
- nvd.nist.gov/vuln/detail/CVE-2026-2327
- security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-10666750
Code Behaviors & Features
Detect and mitigate CVE-2026-2327 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →