Markdown-It Project · weakness class
Denial of Service
9 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.
- Uncontrolled Resource Consumption in markdown-it
- markdown-it html_re.js redos
- Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify…
- markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
- markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
- linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text
- markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
- linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop
- markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.