Every CVE Search/ Get API key

CVE-2022-21670

Uncontrolled Resource Consumption in markdown-it

5.3 MediumFix available

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

2.36%Up 1.5 points since Feb 8, 2022
90%50%10%1%

What each source reports

CVE List Score used 5.3

Uncontrolled Resource Consumption in markdown-it

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.

Record
CVE-2022-21670
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2022-0488 5.3

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.

Record
EUVD-2022-0488
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-6vfc-qv3f-vr6c 5.3

Uncontrolled Resource Consumption in markdown-it

Impact

Special patterns with length > 50K chars can slow down parser significantly.

const md = require('markdown-it')();

md.render(`x ${' '.repeat(150000)} x  \nx`);

Patches

Upgrade to v12.3.2+

Workarounds

No.

References

Fix + test sample: https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101

Record
GHSA-6vfc-qv3f-vr6c
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-400, CWE-1333
Updated
2026-11-02
NVD 5.3

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.

Record
CVE-2022-21670
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-400, CWE-1333
Updated
2026-11-02
OSV 5.3

Uncontrolled Resource Consumption in markdown-it

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.

Record
CVE-2022-21670
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-400
Updated
2026-11-02
OSVDEBIAN-CVE-2022-21670 5.3

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.

Record
DEBIAN-CVE-2022-21670
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
Show 9 moreShow less
OSVGHSA-6vfc-qv3f-vr6c 5.3

Uncontrolled Resource Consumption in markdown-it

Impact

Special patterns with length > 50K chars can slow down parser significantly.

const md = require('markdown-it')();

md.render(`x ${' '.repeat(150000)} x  \nx`);

Patches

Upgrade to v12.3.2+

Workarounds

No.

References

Fix + test sample: https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101

Record
GHSA-6vfc-qv3f-vr6c
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-1333, CWE-400
Updated
2026-11-02
OSVUBUNTU-CVE-2022-21670 5.3

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.

Record
UBUNTU-CVE-2022-21670
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVCLSA-2026-1773015255 No score

TuxCare security update for markdown-it (1 CVE)

TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.3.0-tuxcare.1.

Record
CLSA-2026-1773015255
Updated
2026-11-02
OSVCLSA-2026-1773620215 No score

TuxCare security update for markdown-it (1 CVE)

TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.0.3-tuxcare.1.

Record
CLSA-2026-1773620215
Updated
2026-11-02
OSVCLSA-2026-1774225206 No score

TuxCare security update for markdown-it (2 CVEs)

TuxCare rebuilt markdown-it to address 2 CVEs. Fixed in 8.4.2-tuxcare.1.

Record
CLSA-2026-1774225206
Updated
2026-11-02
OSVCLSA-2026-1789374715 No score

TuxCare security update for markdown-it (1 CVE)

TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.4.0-tuxcare.1.

Record
CLSA-2026-1789374715
Updated
2026-11-02
OSVCLSA-2026-1792369290 No score

TuxCare security update for markdown-it (1 CVE)

TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 12.3.0-tuxcare.1.

Record
CLSA-2026-1792369290
Updated
2026-11-02
OSVCLSA-2026-1794059936 No score

TuxCare security update for markdown-it (5 CVEs)

TuxCare rebuilt markdown-it to address 5 CVEs. Fixed in 10.0.0-tuxcare.1.

Record
CLSA-2026-1794059936
Updated
2026-11-07
OSVROOT-APP-NPM-CVE-2022-21670 No score

CVE-2022-21670 in markdown-it - Patched by Root

Root has patched CVE-2022-21670 in the markdown-it package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2022-21670
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
markdown-it
npm
 before 12.3.2
12.3.2
markdown-it
TuxCare:npm
 4.3.0-tuxcare.0 up to 4.3.0-tuxcare.1, plus listed versions
4.3.0
4.3.0-tuxcare.1
markdown-it
TuxCare:npm
 4.0.3-tuxcare.0 up to 4.0.3-tuxcare.1, plus listed versions
4.0.3
4.0.3-tuxcare.1
markdown-it
TuxCare:npm
From an advisory covering 2 CVEs
 8.4.2-tuxcare.0 up to 8.4.2-tuxcare.1, plus listed versions
8.4.2
8.4.2-tuxcare.1
markdown-it
TuxCare:npm
 4.4.0-tuxcare.0 up to 4.4.0-tuxcare.1, plus listed versions
4.4.0
4.4.0-tuxcare.1
markdown-it
TuxCare:npm
 12.3.0-tuxcare.0 up to 12.3.0-tuxcare.1, plus listed versions
12.3.0
12.3.0-tuxcare.1
markdown-it
TuxCare:npm
From an advisory covering 4 CVEs
 10.0.0-tuxcare.0 up to 10.0.0-tuxcare.1, plus listed versions
10.0.0
10.0.0-tuxcare.1
node-markdown-it
Debian:12
 before 10.0.0+dfsg-6
10.0.0+dfsg-6
node-markdown-it
Debian:13
 before 10.0.0+dfsg-6
10.0.0+dfsg-6
node-markdown-it
Debian:14
 before 10.0.0+dfsg-6
10.0.0+dfsg-6
Show 7 moreShow less
Affected packages
PackageAffectedFixed
markdown-it
Root:npm
 before 12.3.2-aikido.1
12.3.2-aikido.1
@rootio/markdown-it
Root:npm
 before 12.3.2-root.io.1
12.3.2-root.io.1
node-markdown-it
Ubuntu:22.04:LTS
 All versions, plus listed versions
10.0.0+dfsg-210.0.0+dfsg-310.0.0+dfsg-3.110.0.0+dfsg-410.0.0+dfsg-510.0.0+dfsg-6
 None known
node-markdown-it
Ubuntu:24.04:LTS
 All versions, plus listed versions
22.2.3+dfsg+~12.2.3-2
 None known
node-markdown-it
Ubuntu:25.10
 All versions, plus listed versions
22.2.3+dfsg+~12.2.3-2
 None known
node-markdown-it
Ubuntu:26.10
 All versions, plus listed versions
22.2.3+dfsg+~12.2.3-422.2.3+dfsg+~12.2.3-5
 None known
node-markdown-it
Ubuntu:26.04:LTS
 All versions, plus listed versions
22.2.3+dfsg+~12.2.3-222.2.3+dfsg+~12.2.3-4
 None known

History

History
RecordedChangedSources
affected, aliasesOSV
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-21670 is a medium vulnerability (CVSS 5.3) in Markdown-it, published January 10, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.36%, the 83rd percentile. Fixed in markdown-it 12.3.2.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open