MediumGHSA-6vfc-qv3f-vr6cCVE-2022-21670

Uncontrolled Resource Consumption in markdown-it

Published 12 Jan 2022 · Updated 8 Nov 2023

Affected package

markdown-itnpm

Affected: <12.3.2
Fixed in: 12.3.2

Update to the fixed version for your release line, for example:npm install markdown-it@12.3.2

Details

Impact

Special patterns with length > 50K chars can slow down parser significantly.

const md = require('markdown-it')();

md.render(`x ${' '.repeat(150000)} x  \nx`);

Patches

Upgrade to v12.3.2+

Workarounds

No.

References

Fix + test sample: https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101

Is GHSA-6vfc-qv3f-vr6c in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected markdown-it, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.