CVE-2025-58451: Cattown Markdown Parser DoS Vulnerability

CVE-2025-58451 Overview

Cattown is a JavaScript markdown parser distributed through GitHub. Versions prior to 1.0.2 contain regular expressions with inefficient worst-case complexity. Crafted input triggers catastrophic backtracking, causing excessive CPU consumption during parsing.

The flaw is classified as a Regular Expression Denial of Service (ReDoS) issue and maps to CWE-400: Uncontrolled Resource Consumption. Attackers can submit malicious markdown payloads to any service that processes user-supplied content with Cattown. Sustained processing of such inputs leads to resource exhaustion and denial of service. Version 1.0.2 ships a corrected regex pattern.

Critical Impact
Remote, unauthenticated attackers can exhaust CPU resources on any application that parses untrusted markdown through Cattown versions below 1.0.2, resulting in denial of service.

Affected Products

Cattown JavaScript markdown parser, all versions prior to 1.0.2
Node.js applications and services embedding the vulnerable Cattown package
Web applications rendering user-supplied markdown through Cattown

Discovery Timeline

2025-09-08 - CVE-2025-58451 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-58451

Vulnerability Analysis

The vulnerability resides in regular expressions used by Cattown to tokenize markdown syntax. The affected patterns contain nested or overlapping quantifiers that produce exponential matching time on adversarial input. When the regex engine encounters non-matching input, it backtracks through every possible combination before failing.

Processing time grows non-linearly with input length. A payload of a few hundred bytes can occupy a single CPU core for seconds or longer. Because Node.js executes JavaScript on a single thread per process, the event loop blocks while the regex runs. Concurrent requests queue behind the stalled parser, amplifying the impact across the affected service.

Root Cause

The root cause is ambiguous regex constructs that allow the engine to reach a state where multiple sub-patterns can match the same characters. The corrected version 1.0.2 rewrites these expressions to remove the ambiguity. The patch is available in commit 70c2a28.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted markdown to any endpoint that invokes Cattown for parsing. This includes comment forms, document upload features, chat services, and CI/CD systems that render README files. Repeated submissions amplify the denial of service across worker processes. Refer to the GitHub Security Advisory GHSA-455v-w7r9-3vv9 for vendor details.

Detection Methods for CVE-2025-58451

Indicators of Compromise

Sustained CPU utilization at or near 100% on a Node.js worker process correlated with markdown parsing activity.
Event loop lag metrics spiking when specific HTTP requests are processed.
Inbound requests containing unusually long sequences of repeated markdown delimiter characters such as asterisks, brackets, or backticks.
Application logs showing parser invocations that never return or exceed configured timeouts.

Detection Strategies

Inventory project dependency manifests (package.json, package-lock.json, yarn.lock) for Cattown entries below version 1.0.2.
Instrument application telemetry to record per-request CPU time and flag outliers tied to markdown rendering endpoints.
Deploy web application firewall rules that limit request body size and reject inputs with excessive repetition of markdown control characters.

Monitoring Recommendations

Track Node.js event loop lag and process CPU saturation per service through application performance monitoring.
Alert on sudden drops in request throughput accompanied by rising response latency on endpoints that parse markdown.
Forward web server and application logs to a centralized analytics platform and correlate slow requests with payload characteristics.

How to Mitigate CVE-2025-58451

Immediate Actions Required

Upgrade Cattown to version 1.0.2 or later across all projects and rebuild affected applications.
Audit transitive dependencies to confirm no vendored copies of vulnerable Cattown versions remain.
Apply input size limits and request timeouts on endpoints that accept user-supplied markdown.

Patch Information

The maintainers released version 1.0.2, which replaces the vulnerable regular expressions. The fix is contained in commit 70c2a28fb7dc520cfb7e401e0e141bff3dd26ead. Consult the GitHub Security Advisory GHSA-455v-w7r9-3vv9 for full advisory text and version details.

Workarounds

Restrict markdown parsing to authenticated and trusted users until the upgrade is deployed.
Enforce a maximum input length on markdown fields, rejecting payloads above a small threshold such as 8 KB.
Run markdown parsing inside a worker thread or child process with a hard execution timeout to contain stalls.
Place a reverse proxy in front of the application with rate limiting on endpoints that invoke the parser.

bash

# Upgrade Cattown to the patched release
npm install cattown@1.0.2 --save
npm audit