CVE-2026-2327 markdown-it is has a Regular Expression Denial of Service (ReDoS)
An attacker can cause a denial of service in markdown-it by supplying crafted input that triggers excessive regex backtracking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-2327?
CVE-2026-2327 is a medium-severity denial of service vulnerability in markdown-it, published on 12 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.
Weakness: CWE-1333
Which versions are affected by CVE-2026-2327?
2 open source packages ship an affected version, including markdown-it. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
markdown-it npm | From 13.0.0 | 14.1.1 |
markdown-it npm | From 13.0.0 | 14.1.1 |
Products include Markdown-It Project Markdown-It.
How do I fix CVE-2026-2327?
Upgrade markdown-it to 14.1.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-2327 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-2327 exists.
Other vulnerabilities in markdown-it
- CVE-2025-7969 Markdown-it 14.1.0 - Cross-site scripting (XSS)
- CVE-2026-48988 markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
- CVE-2022-21670 Uncontrolled Resource Consumption in markdown-it
- CVE-2015-3295 Cross-site scripting in n/a
- CVE-2015-10005 markdown-it html_re.js redos
Sources
Also known as CLEANSTART-2026-BO70828, CLEANSTART-2026-PN19666, CLSA-2026-1774225205, ECHO-1dc3-49dc-a4e2, GHSA-38c4-r59v-3vqw, MINI-37qg-w249-w28g and 12 more.