markdown-it is has a Regular Expression Denial of Service (ReDoS)

高 7.5CVE-2026-2327 · GHSA-38c4-r59v-3vqw · 12/02/2026 公開 · 17/06/2026 更新

要点

CVE-2026-2327 は markdown-it (markdown-it project), markdown-it に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.74%（全脆弱性の 54.7% より高い）。
対処：14.1.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
markdown-it markdown-it_project	`≥ 13.0.0, < 14.1.1`	`14.1.1`
markdown-it npm	`≥ 13.0.0, < 14.1.1`	`14.1.1`

概要

Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.

NVD の説明

Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.