CVE-2026-2327: markdown-it ReDoS Vulnerability

CVE-2026-2327 Overview

CVE-2026-2327 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting the markdown-it JavaScript package. Versions from 13.0.0 and before 14.1.1 are vulnerable due to the use of an inefficient regular expression pattern /\*+$/ in the linkify function. An attacker can exploit this vulnerability by supplying a specially crafted input containing a long sequence of asterisk (*) characters followed by a non-matching character, which triggers excessive backtracking in the regex engine and may lead to a denial-of-service condition.

Critical Impact

Applications using vulnerable versions of markdown-it may become unresponsive when processing malicious input, potentially affecting service availability for all users.

Affected Products

• markdown-it 13.0.0 to 14.1.0
• Applications and services using vulnerable markdown-it versions for Markdown parsing
• Node.js projects with markdown-it as a dependency

Discovery Timeline

• 2026-02-12 - CVE-2026-2327 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-2327

Vulnerability Analysis

This vulnerability falls under CWE-1333 (Inefficient Regular Expression Complexity). The root issue lies in how the regex engine processes the pattern /\*+$/ when presented with adversarial input. When an attacker provides a string containing many consecutive asterisk characters that does not match the expected pattern, the regex engine enters a state of catastrophic backtracking. This occurs because the greedy + quantifier combined with the end-of-string anchor $ causes the engine to repeatedly attempt different combinations before ultimately failing to match, consuming excessive CPU resources in the process.

The vulnerability is remotely exploitable over a network without requiring authentication or user interaction. While it does not compromise confidentiality or integrity, it can significantly impact availability by exhausting server resources.

Root Cause

The vulnerability stems from an inefficient regular expression pattern in the linkify.mjs module at line 33. The pattern /\*+$/ uses a greedy quantifier (+) that matches one or more asterisks at the end of a string. When the input contains a long sequence of asterisks followed by a character that prevents the pattern from matching, the regex engine must backtrack through all possible combinations of asterisk groupings before determining that no match exists. This exponential time complexity relative to input length creates the ReDoS condition.

Attack Vector

The attack vector is network-based, allowing remote attackers to submit malicious Markdown content to any application that processes user-supplied input using vulnerable markdown-it versions. The attack requires no special privileges or user interaction. An attacker simply needs to craft input containing a long string of asterisk characters followed by a non-matching character. When this input is processed by the linkify function, the application thread becomes blocked while the regex engine backtracks, potentially causing service degradation or complete denial of service.

The vulnerability mechanism exploits regex backtracking behavior. For detailed technical analysis, see the security researcher's proof of concept and the vulnerable code in the linkify module.

Detection Methods for CVE-2026-2327

Indicators of Compromise

• Unusual CPU spikes when processing Markdown content
• Application timeouts or unresponsive behavior during content parsing
• Request logs showing submissions containing long sequences of asterisk characters
• Increased memory usage in Node.js processes handling Markdown rendering

Detection Strategies

• Implement application performance monitoring to detect abnormal processing times for Markdown parsing operations
• Configure web application firewalls (WAF) to flag requests containing unusually long strings of repetitive characters
• Use dependency scanning tools (npm audit, Snyk, or similar) to identify vulnerable markdown-it versions in your codebase
• Monitor Node.js event loop lag as an indicator of potential ReDoS attacks

Monitoring Recommendations

• Set up alerts for request processing times exceeding normal thresholds on endpoints that handle Markdown content
• Implement rate limiting on user-submitted content endpoints to reduce the impact of repeated attack attempts
• Enable verbose logging for content processing operations to aid in forensic analysis
• Monitor container and process resource utilization for services using markdown-it

How to Mitigate CVE-2026-2327

Immediate Actions Required

• Upgrade markdown-it to version 14.1.1 or later immediately
• Audit your application dependencies to identify all instances of vulnerable markdown-it versions
• Implement input length restrictions on user-submitted Markdown content as a defense-in-depth measure
• Consider implementing request timeouts for content processing operations

Patch Information

The markdown-it maintainers have addressed this vulnerability in version 14.1.1. The fix involves optimizing the regular expression pattern to prevent catastrophic backtracking. The specific fix can be reviewed in the commit addressing this vulnerability. For additional details, see the Snyk vulnerability advisory.

Workarounds

• Implement input validation to limit the maximum length of user-submitted content containing repetitive special characters
• Add request timeout configurations to prevent individual requests from consuming excessive resources
• Deploy a reverse proxy or WAF with regex-based filtering to block suspicious input patterns
• Consider implementing content processing in separate worker threads or processes with strict resource limits

# Update markdown-it to patched version
npm update markdown-it@14.1.1

# Verify installed version
npm list markdown-it

# Audit dependencies for vulnerabilities
npm audit