# CVE-2015-10005: markdown-it inefficient regular expression complexity

Source: https://junglewise.ai/threats/cve-2015-10005-markdown-it-inefficient-regular-expression-complexity  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-12-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2015-10005 · Severity: low · CVSS 3.1 · Published 2022-12-27

markdown-it is a popular JavaScript library for parsing and rendering Markdown to HTML, widely used in web applications and content management systems. An inefficient regular expression in the library's HTML parsing code can cause excessive CPU consumption when processing specially crafted input, potentially leading to denial-of-service conditions where the application becomes unresponsive.

Technologies: [markdown-it (npm)](https://junglewise.ai/threats/technologies/markdown-it). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2015-10005 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2015-10005 being exploited in the wild.

**How severe is CVE-2015-10005?** Low severity, with a CVSS score of 3.1, published 27 December 2022.

**Which products and versions are affected?** markdown-it (npm) SEMVER:introduced=0,fixed=3.0.0.

**Is there a fix for CVE-2015-10005?** Yes. markdown-it (npm): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2015-10005 attacked?** It is attacked over the network.

**Am I affected by CVE-2015-10005?** Check whether you run markdown-it (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- markdown-it (npm): upgrade to 3.0.0 or later

  ```sh
  npm install markdown-it@3.0.0
  ```


## Technical details

The vulnerability is a ReDoS (Regular Expression Denial of Service) issue in the HTML regex patterns located in lib/common/html_re.js, specifically affecting the CDATA handling regex. The flaw involves an inefficient regular expression (CWE-1333) that can exhibit catastrophic backtracking when processing malicious input. An unauthenticated attacker can send specially crafted Markdown input to an application using vulnerable versions of markdown-it, causing the regex engine to consume excessive CPU resources and hang the application. The vulnerability affects all versions prior to 3.0.0, which introduced a regex fix (commit 89c8620). Patching involves upgrading to version 3.0.0 or later.

## Affected products

- markdown-it markdown-it < 3.0.0

## Identifiers

- CVE-2015-10005
- GHSA-j5p7-jf4q-742q

## Timeline

- 2022-12-27: disclosed
- 2022-12-27: patched: Fixed in version 3.0.0

## References

- [https://github.com/markdown-it/markdown-it/commit/89c8620157d6e38f9872811620d25138fc9d1b0d](https://github.com/markdown-it/markdown-it/commit/89c8620157d6e38f9872811620d25138fc9d1b0d)

## Related threats

- [markdown-it quadratic-time rendering of unclosed link reference](https://junglewise.ai/threats/cve-2026-111758-markdown-it-quadratic-time-rendering-of-a-single-multi-line-link)
- [markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled](https://junglewise.ai/threats/cve-2026-111766-markdown-it-is-a-markdown-parser-prior-to-14-3-3-and-15-0-3-when)
- [markdown-it quadratic ReDoS in smartquotes](https://junglewise.ai/threats/cve-2026-111759-markdown-it-is-a-markdown-parser-prior-to-14-3-2-and-15-0-2-when)
- [markdown-it denial of service in smartquotes rule](https://junglewise.ai/threats/cve-2026-48988-markdown-it-denial-of-service-in-smartquotes-rule)
- [markdown-it ReDoS in linkify regex](https://junglewise.ai/threats/cve-2026-2327-markdown-it-redos-in-linkify-function)