Executive brief
markdown-it is a popular JavaScript library for parsing and rendering Markdown. A specially crafted Markdown document containing patterns longer than 50KB can cause the parser to consume excessive CPU resources and become unresponsive, potentially disrupting any application that relies on it to process user-supplied content.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) / uncontrolled resource consumption flaw in the newline rule regex processing. Attackers can craft Markdown input with specific patterns (e.g., large sequences of whitespace) exceeding 50KB that trigger excessive backtracking in the parser's regex engine, causing significant CPU consumption and parser slowdown. The vulnerability requires no authentication and can be triggered by providing malicious input to the render() function. An attacker can cause a denial of service by making the application hang or become unresponsive. The vulnerability is fixed in version 12.3.2 and later.
Affected products
- markdown-it markdown-it <12.3.2
Timeline
- 2022-01-08: disclosed: Security advisory published
- 2022-01-12: patched: Fixed in version 12.3.2