CVE-2026-2327: Medium severity npm/markdown-it vulnerability
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\+$/ in the linkify function. An attacker can supply a long sequence of characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2327?
CVE-2026-2327 is classified as a Regular Expression Denial of Service (ReDoS) vulnerability.
How do I fix CVE-2026-2327?
To fix CVE-2026-2327, upgrade the markdown-it package to version 14.1.1 or later.
Which versions are affected by CVE-2026-2327?
CVE-2026-2327 affects markdown-it versions from 13.0.0 up to, but not including, 14.1.1.
What kind of attack can exploit CVE-2026-2327?
CVE-2026-2327 can be exploited through a Regular Expression Denial of Service (ReDoS) attack by supplying a specific pattern of characters.
Where does the vulnerability CVE-2026-2327 occur?
CVE-2026-2327 occurs in the linkify function of the markdown-it package.