{"id":"CVE-2026-2327","aliases":["CLSA-2026-1774225205","EUVD-2026-7037","GHSA-38c4-r59v-3vqw","ROOT-APP-NPM-CVE-2026-2327","UBUNTU-CVE-2026-2327"],"status":"published","title":"markdown-it is has a Regular Expression Denial of Service (ReDoS)","description":"Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00728,"percentile":0.54511,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2026-02-12T05:00:07Z","modified":"2026-10-28T02:30:23Z","fixes":[{"ecosystem":"npm","package":"markdown-it","fixed_in":["14.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"markdown-it","fixed_in":["13.0.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"markdown-it","fixed_in":["14.1.0-aikido.2","14.1.0-aikido.3","14.1.0-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/markdown-it","fixed_in":["14.1.0-root.io.1","14.1.0-root.io.2","14.1.0-root.io.3","14.1.0-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"14.1.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.2-tuxcare.0"},{"fixed":"13.0.2-tuxcare.1"}]}],"versions":["13.0.2"]},{"source":"osv","ecosystem":"npm","package":"markdown-it","ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"},{"fixed":"14.1.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.0-aikido.2"},{"fixed":"14.1.0-aikido.3"},{"fixed":"14.1.0-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.0-root.io.1"},{"fixed":"14.1.0-root.io.2"},{"fixed":"14.1.0-root.io.3"},{"fixed":"14.1.0-root.io.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0+dfsg-2","10.0.0+dfsg-3","10.0.0+dfsg-3.1","10.0.0+dfsg-4","10.0.0+dfsg-5","10.0.0+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-4","22.2.3+dfsg+~12.2.3-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-2","22.2.3+dfsg+~12.2.3-4"]}],"products":[{"vendor":"markdown-it","product":"markdown-it"},{"vendor":"markdown-it_project","product":"markdown-it"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-10666750","tags":["exploit","Third Party Advisory","web","report"]},{"url":"https://gist.github.com/ltduc147/c9abecae1b291ede4f692f2ab988c917","tags":["exploit","Vendor Advisory","web","report"]},{"url":"https://github.com/markdown-it/markdown-it/blob/14.1.0/lib/rules_inline/linkify.mjs%23L33","tags":["Broken Link","web","report"]},{"url":"https://github.com/markdown-it/markdown-it/commit/4b4bbcae5e0990a5b172378e507b33a59012ed26","tags":["Patch","Product","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2327","tags":["advisory"]},{"url":"https://github.com/markdown-it/markdown-it/blob/14.1.0/lib/rules_inline/linkify.mjs#L33","tags":["web"]},{"url":"https://github.com/advisories/GHSA-38c4-r59v-3vqw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2327.json","tags":["advisory"]},{"url":"https://github.com/markdown-it/markdown-it","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-2327","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2327","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-2327","description":"Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.","status":"published","published":"2026-02-12T05:00:07.369Z","modified":"2026-02-12T14:41:53.714Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T13:48:46.911326Z"}],"euvd":[{"id":"EUVD-2026-7037","description":"Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.","status":"published","published":"2026-02-12T05:00:07Z","modified":"2026-02-12T14:41:53Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T19:48:40.418792Z"}],"ghsa":[{"id":"GHSA-38c4-r59v-3vqw","title":"markdown-it is has a Regular Expression Denial of Service (ReDoS)","description":"Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.","status":"published","published":"2026-02-12T06:30:13Z","modified":"2026-02-13T20:04:40Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:39:24.742346Z"}],"nvd":[{"id":"CVE-2026-2327","description":"Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.","status":"published","published":"2026-02-12T06:16:02.243Z","modified":"2026-06-17T10:30:47.55Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:12:05.908608Z"}],"osv":[{"id":"CVE-2026-2327","description":"Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.","status":"published","published":"2026-02-12T05:00:07.369Z","modified":"2026-10-28T02:30:23.747202819Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:44:58.749922Z"},{"id":"GHSA-38c4-r59v-3vqw","title":"markdown-it is has a Regular Expression Denial of Service (ReDoS)","description":"Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.","status":"published","published":"2026-02-12T06:30:13Z","modified":"2026-09-10T03:50:33.896962866Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"ROOT-APP-NPM-CVE-2026-2327","title":"CVE-2026-2327 in markdown-it - Patched by Root","description":"Root has patched CVE-2026-2327 in the markdown-it package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-26T07:30:13Z","modified":"2026-10-26T08:15:05.077698298Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"UBUNTU-CVE-2026-2327","description":"Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.","status":"published","published":"2026-02-12T06:16:00Z","modified":"2026-10-17T12:59:55.727074798Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T16:56:04.456047Z"},{"id":"CLSA-2026-1774225205","title":"TuxCare security update for markdown-it (1 CVE)","description":"TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 13.0.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:45:08.990943077Z","updated_at":"2026-11-02T15:43:43.621843Z"}]}}