Markdown-it vulnerabilities
We track 5 vulnerabilities in Markdown-it products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 20, 2026.
Latest Markdown-it vulnerabilities
- 7.5 High severity
markdown-it: Uncontrolled Resource Consumption
markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent i
- 7.5 High severity
markdown-it: Uncontrolled Resource Consumption
markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrust
- 7.5 High severity
linkify-it: Inefficient Regular Expression Complexity
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level sca
- 7.5 High severity
linkify-it: Inefficient Algorithmic Complexity
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing
- 7.5 High severity
markdown-it: Inefficient Regular Expression Complexity
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a no