CVE catalog

CVE-2026-2327

node-markdown-it: CVE-2026-2327

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.74% · Oct 25, 2026

Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-markdown-itsid22.2.3+dfsg+~12.2.3-5not affected
Debiannode-markdown-itforky22.2.3+dfsg+~12.2.3-5not affected
Debiannode-markdown-ittrixie22.2.3+dfsg+~12.2.3-2not affected
Debiannode-markdown-itbookworm22.2.3+dfsg+~12.2.3-2not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-markdown-itsourcesidNot affectedunimportantNot reportedNot reported
Debiannode-markdown-itsourceforkyNot affectedunimportantNot reportedNot reported
Debiannode-markdown-itsourcetrixieNot affectedunimportantNot reportedNot reported
Debiannode-markdown-itsourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-markdown-it]Not affected
    Details (2)

    • 22.2.3+dfsg+~12.2.3-2 · all · bookworm

      Not affected

      dsa · node-markdown-it · debian · bookworm

    • 22.2.3+dfsg+~12.2.3-2 · all · bookworm

      Not affected

      dsa · node-markdown-it · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX]