markdown-it vulnerabilities
Markdown-it - modern pluggable markdown parser.
- Registry
- npm
- Latest
- 15.0.3
- License
- MIT
8 known advisories
The latest version, 15.0.3, is not affected by any of them. Projects on older versions may be.
npm install markdown-it@15.0.3Security advisories for markdown-it
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
- Affected
- >=14.1.0 <14.3.3 · >=15.0.0 <15.0.3
- Fixed in
- 14.3.3, 15.0.3
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
- Affected
- <14.3.3 · >=15.0.0 <15.0.3
- Fixed in
- 14.3.3, 15.0.3
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
- Affected
- >=15.0.0 <15.0.2 · <14.3.2
- Fixed in
- 14.3.2, 15.0.2
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
- Affected
- >=15.0.0 <15.0.1 · <14.3.1
- Fixed in
- 14.3.1, 15.0.1
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
- Affected
- <14.2.0
- Fixed in
- 14.2.0
markdown-it is has a Regular Expression Denial of Service (ReDoS)
- Affected
- >=13.0.0 <14.1.1
- Fixed in
- 14.1.1
markdown-it vulnerable to Inefficient Regular Expression Complexity
- Affected
- <3.0.0
- Fixed in
- 3.0.0
Uncontrolled Resource Consumption in markdown-it
- Affected
- <12.3.2
- Fixed in
- 12.3.2
Which of your client projects still run an old markdown-it?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.