Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
8 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. It is a regression introduced by PR #1004 in 14.0.0: 13.0.2 processed a 313 KB input in 125 ms, while every version since takes about 11 seconds on the same input. At the sizes below, 200 KB takes 3.6 seconds, 400 KB takes 18.1 seconds, and 800 KB takes 74.0 seconds, which is roughly 4–5× per doubling. No options are required to trigger it. Details src/rulesblock/reference.ts appends continuation lines with str += lineContent at lines 74, 83, 100, 133, and 150, then keeps indexing the accumulated string via str.charCodeAt(pos) in the label and whitespace loops and str.slice(...) in parseLinkTitle. V8…
Recommended action: Upgrade to 15.0.3 or 14.3.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
With html: true, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments (<!--), processing instructions (<?), declarations (<!A), and CDATA sections (<!CDATA[). An attacker-controlled input of a few hundred kilobytes can block the Node.js event loop for seconds or tens of seconds. The default configuration has HTML disabled, but the commonmark preset enables it. The issue was reported against the published markdown-it@15.0.2 package on Node.js 20 and reproduced on the current source with Node.js 24.16.0. Details src/rulesinline/text.ts treats < as a terminator, causing the inline parser to attempt the HTML rule at successive HTML construct openers. With HTML enabled, src/rulesinline/htmlinline.ts applies an anchored regular expression to the remaining input: The comment, processing instruction, declaration, and CDATA alternatives in src/common/htmlre.ts scan the remaining input for their respective…
Recommended action: Upgrade to 15.0.3 or 14.3.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. Reproduction Result: |input size|time| |-|-| |12000|18ms| |24000|47ms| |48000|115ms| |96000|428ms| |192000|1586ms| Patches Fixed in 15.0.2 and 14.3.2. Workarounds Disable typography with typographer: false, or disable only the smartquotes rule:
Recommended action: Upgrade to 15.0.2 or 14.3.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads. src/rulescore/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each time. A paragraph of N soft-broken lines is one inline token with about 2N children, so you get N rebuilds over a 2N array. Schema-less emails are what reach it. A http:// link gets consumed by the inline rule first and never arrives as a text token, so those stay linear. src/rulesinline/linkify.ts runs state.pending.match(SCHEMERE) at every :// in the source. state.pending only gets truncated once a link is actually produced, so an unregistered scheme leaves it growing and every :// rescans the lot. Proof of concept Clean install of 15.0.0 from npm, new MarkdownIt({ linkify: true }).render(payload), Node 24. | N | 5,000 | 10,000 | 20,000 | 40,000 | |---|---|---|---|---| | 'a@b.co\n'.repeat(N),…
Recommended action: Upgrade to 15.0.1 or 14.3.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A quadratic time complexity vulnerability exists in markdown-it's smartquotes rule (enabled via the typographer: true option). An attacker can craft a markdown input consisting of consecutive quotation marks that causes the parser to consume excessive CPU time, leading to denial of service. Details The vulnerability is in the replaceAt() helper function used by the smartquotes rule in lib/rulescore/smartquotes.mjs: When markdown-it processes a text token containing many quotation marks (either " or ') with typographer: true, the smartquotes rule iterates through each quote character and calls replaceAt() to substitute it with a typographic (curly) quote. Each call to replaceAt() creates three new string slices and concatenates them, which is an O(n) operation where n is the length of the string. Since this is called once per quote character in the token, and there are n quote characters, the total time complexity becomes O(n^2). The root cause is that the smartquotes rule…
Recommended action: Upgrade to 14.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\+$/ in the linkify function. An attacker can supply a long sequence of characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.
Recommended action: Upgrade to 14.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/htmlre.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 89c8620157d6e38f9872811620d25138fc9d1b0d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.
Recommended action: Upgrade to 3.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Special patterns with length 50K chars can slow down parser significantly. Patches Upgrade to v12.3.2+ Workarounds No. References Fix + test sample: https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101
Recommended action: Upgrade to 12.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.