Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-2327 Regular Expression Denial of Service (ReDoS) in markdown-it Package Before 14.1.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2327
Post summary
The text announces CVE-2026-2327, a ReDoS vulnerability in markdown-it prior to version 14.1.1, without any evidence of exploitation, PoC, or patching.
CVE-2026-2327 Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in t… https://www.cve.org/CVERecord?id=CVE-2026-2327
Post summary
The message discloses a ReDoS flaw in markdown-it versions 13.0.0 through 14.1.1 caused by a specific regex pattern.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | markdown-it_project | markdown-it | - | - | - |