Uncontrolled Resource Consumption in markdown-it
### Impact Special patterns with length > 50K chars can slow down parser significantly. ```js const md = require('markdown-it')(); md.render(`x ${' '.repeat(150000)} x \nx`); ``` ### Patches Upgrade to v12.3.2+ ### Workarounds No. ### References Fix + test sample: https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-21670US | medium5.3 | — | ||
markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should u… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan