Vulnerability in Markdown-it_project Markdown-it
CVE-2026-2327
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An attacker can supply a long sequence of * charac…
Vulnerability class: ReDoS (Regular Expression Denial of Service)
EPSS: 0.005 (39.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Markdown-it_project Markdown-it
- N/a Markdown-it — versions 13.0.0
Weakness classification (CWE)
References
- report@snyk.io (Third Party Advisory)
- report@snyk.io (Vendor Advisory)
- report@snyk.io (Broken Link)
- report@snyk.io (Product, Patch)
Frequently asked questions
- What is CVE-2026-2327?
- CVE-2026-2327 is a medium-severity vulnerability in Markdown-it_project Markdown-it, classified under Inefficient Regular Expression Complexity. CVSS score: 5.3/10. Published 2026-02-12.
- How severe is CVE-2026-2327?
- Medium severity. CVSS v3 base score is 5.3 out of 10.