{"id":"CVE-2022-21670","aliases":["CLSA-2026-1773015255","CLSA-2026-1773620215","CLSA-2026-1774225206","CLSA-2026-1789374715","CLSA-2026-1792369290","CLSA-2026-1794059936","DEBIAN-CVE-2022-21670","EUVD-2022-0488","GHSA-253c-mchw-3w2r","GHSA-6vfc-qv3f-vr6c","ROOT-APP-NPM-CVE-2022-21670","UBUNTU-CVE-2022-21670"],"status":"published","title":"Uncontrolled Resource Consumption in markdown-it","description":"markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02357,"percentile":0.83869,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-400"],"published":"2022-01-10T20:40:10Z","modified":"2026-11-07T19:00:39Z","fixes":[{"ecosystem":"npm","package":"markdown-it","fixed_in":["12.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"markdown-it","fixed_in":["4.3.0-tuxcare.1","4.0.3-tuxcare.1","4.4.0-tuxcare.1","12.3.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-markdown-it","fixed_in":["10.0.0+dfsg-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-markdown-it","fixed_in":["10.0.0+dfsg-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-markdown-it","fixed_in":["10.0.0+dfsg-6"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"markdown-it","fixed_in":["12.3.2-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/markdown-it","fixed_in":["12.3.2-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0-tuxcare.0"},{"fixed":"4.3.0-tuxcare.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.1"}]}],"versions":["4.0.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.2-tuxcare.0"},{"fixed":"8.4.2-tuxcare.1"}]}],"versions":["8.4.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0-tuxcare.0"},{"fixed":"4.4.0-tuxcare.1"}]}],"versions":["4.4.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.3.0-tuxcare.0"},{"fixed":"12.3.0-tuxcare.1"}]}],"versions":["12.3.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-tuxcare.0"},{"fixed":"10.0.0-tuxcare.1"}]}],"versions":["10.0.0"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0+dfsg-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0+dfsg-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0+dfsg-6"}]}]},{"source":"osv","ecosystem":"npm","package":"markdown-it","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"12.3.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.2-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.2-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0+dfsg-2","10.0.0+dfsg-3","10.0.0+dfsg-3.1","10.0.0+dfsg-4","10.0.0+dfsg-5","10.0.0+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-4","22.2.3+dfsg+~12.2.3-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-2","22.2.3+dfsg+~12.2.3-4"]}],"products":[{"vendor":"markdown-it","product":"markdown-it"},{"vendor":"markdown-it_project","product":"markdown-it"}],"references":[{"url":"https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6vfc-qv3f-vr6c","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21670","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6vfc-qv3f-vr6c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21670.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-21670","tags":["advisory"]},{"url":"https://github.com/markdown-it/markdown-it","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-21670","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21670","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-21670","title":"Uncontrolled Resource Consumption in markdown-it","description":"markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.","status":"published","published":"2022-01-10T20:40:10Z","modified":"2025-04-22T18:33:46.2Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:29.057251Z"}],"euvd":[{"id":"EUVD-2022-0488","description":"markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.","status":"published","published":"2022-01-10T20:40:10Z","modified":"2025-04-22T18:33:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:15.026784Z"}],"ghsa":[{"id":"GHSA-6vfc-qv3f-vr6c","title":"Uncontrolled Resource Consumption in markdown-it","description":"### Impact\n\nSpecial patterns with length \u003e 50K chars can slow down parser significantly.\n\n```js\nconst md = require('markdown-it')();\n\nmd.render(`x ${' '.repeat(150000)} x  \\nx`);\n```\n\n\n### Patches\n\nUpgrade to v12.3.2+\n\n### Workarounds\n\nNo.\n\n### References\n\nFix + test sample: https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101\n","status":"published","published":"2022-01-12T22:20:22Z","modified":"2023-07-24T19:33:44Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:36:58.177785Z"}],"nvd":[{"id":"CVE-2022-21670","description":"markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.","status":"published","published":"2022-01-10T21:15:07.967Z","modified":"2026-06-17T04:26:43.707Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:07:10.836864Z"}],"osv":[{"id":"CVE-2022-21670","title":"Uncontrolled Resource Consumption in markdown-it","description":"markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.","status":"published","published":"2022-01-10T20:40:10Z","modified":"2026-10-28T02:30:26.193875168Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"DEBIAN-CVE-2022-21670","description":"markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.","status":"published","published":"2022-01-10T21:15:07.967Z","modified":"2026-11-03T08:02:38.082107885Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"GHSA-6vfc-qv3f-vr6c","title":"Uncontrolled Resource Consumption in markdown-it","description":"### Impact\n\nSpecial patterns with length \u003e 50K chars can slow down parser significantly.\n\n```js\nconst md = require('markdown-it')();\n\nmd.render(`x ${' '.repeat(150000)} x  \\nx`);\n```\n\n\n### Patches\n\nUpgrade to v12.3.2+\n\n### Workarounds\n\nNo.\n\n### References\n\nFix + test sample: https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101\n","status":"published","published":"2022-01-12T22:20:22Z","modified":"2023-11-08T04:08:07.059316Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1333","CWE-400"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"UBUNTU-CVE-2022-21670","description":"markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.","status":"published","published":"2022-01-10T21:15:00Z","modified":"2026-10-17T12:56:02.155776557Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"CLSA-2026-1773015255","title":"TuxCare security update for markdown-it (1 CVE)","description":"TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.3.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:45:27.17991162Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773620215","title":"TuxCare security update for markdown-it (1 CVE)","description":"TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.0.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:46.895781544Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774225206","title":"TuxCare security update for markdown-it (2 CVEs)","description":"TuxCare rebuilt markdown-it to address 2 CVEs. Fixed in 8.4.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:01.489723869Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1789374715","title":"TuxCare security update for markdown-it (1 CVE)","description":"TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.4.0-tuxcare.1.","status":"published","published":"2026-09-14T08:31:55Z","modified":"2026-10-15T09:48:03.861491399Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1792369290","title":"TuxCare security update for markdown-it (1 CVE)","description":"TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 12.3.0-tuxcare.1.","status":"published","published":"2026-10-19T00:21:30Z","modified":"2026-10-19T07:47:04.228508883Z","updated_at":"2026-11-02T15:43:53.353888Z"},{"id":"CLSA-2026-1794059936","title":"TuxCare security update for markdown-it (5 CVEs)","description":"TuxCare rebuilt markdown-it to address 5 CVEs. Fixed in 10.0.0-tuxcare.1.","status":"published","published":"2026-11-07T14:58:57Z","modified":"2026-11-07T19:00:39.606191823Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"ROOT-APP-NPM-CVE-2022-21670","title":"CVE-2022-21670 in markdown-it - Patched by Root","description":"Root has patched CVE-2022-21670 in the markdown-it package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-21T13:36:17Z","modified":"2026-09-21T14:15:03.283786937Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}