# CVE-2024-1899: Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing

Source: https://junglewise.ai/threats/cve-2024-1899-showdown-vulnerable-to-regular-expression-denial-of-service-redos  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-02-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-1899 · Severity: medium · CVSS 5.3 · Published 2024-02-26

Showdown is a JavaScript library that converts Markdown to HTML and vice versa, commonly used in web applications and content management systems. A regular expression denial of service (ReDoS) vulnerability in its link/anchor parsing allows an attacker to craft malicious input that causes the library to consume excessive CPU resources, potentially freezing or crashing applications that process user-supplied Markdown.

Technologies: [showdown (npm)](https://junglewise.ai/threats/technologies/showdown). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-1899 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-1899 being exploited in the wild.

**How severe is CVE-2024-1899?** Medium severity, with a CVSS score of 5.3, published 26 February 2024.

**Which products and versions are affected?** showdown (npm) <= 2.1.0, SEMVER:introduced=0,last_affected=2.1.0.

**Is there a fix for CVE-2024-1899?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-1899 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-1899?** Check whether you run showdown (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the anchors subparser component of Showdown, which uses a nested regular expression to parse Markdown links. This regex pattern is susceptible to catastrophic backtracking when processing specially crafted input, leading to denial of service conditions. The attack is network-reachable and requires no authentication or user interaction beyond supplying malicious Markdown content; an attacker can send a maliciously formatted string to any application using Showdown to trigger the ReDoS. The vulnerable code affects all versions up to and including 2.1.0. A patch addressing this issue is expected to be available in future releases.

## Affected products

- Showdown Showdown <=2.1.0

## Identifiers

- CVE-2024-1899
- GHSA-rmmh-p597-ppvv

## Timeline

- 2024-02-26: disclosed: GHSA-rmmh-p597-ppvv published
- 2024-02-26: other: CVE-2024-1899 assigned

## References

- [https://github.com/showdownjs/showdown](https://github.com/showdownjs/showdown)

## Related threats

- [Showdown stored XSS in table header ID attributes](https://junglewise.ai/threats/cve-2026-59710-showdown-stored-xss-in-table-header-id-attributes)
- [showdownjs showdown XSS in metadata title handling](https://junglewise.ai/threats/cve-2026-59711-showdownjs-showdown-xss-in-metadata-title-handling)
- [showdown reverse tabnabbing in anchor tags](https://junglewise.ai/threats/showdown-reverse-tabnabbing-in-anchor-tags-ec12f775)