CVE-2022-21670: Uncontrolled Resource Consumption in markdown-it
Impact
Special patterns with length > 50K chars can slow down parser significantly.
js const md = require('markdown-it')();
md.render(x ${' '.repeat(150000)} x \nx);
Patches
Upgrade to v12.3.2+
Workarounds
No.
References
Fix + test sample: https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101
Other sources
markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/markdown-itto a version that resolves this vulnerability.Fixed in 12.3.2 - Upgrade
Upgrade
debian/node-markdown-itto a version that resolves this vulnerability.Fixed in 22.2.3+dfsg+~12.2.3-2Fixed in 22.2.3+dfsg+~12.2.3-5 - Upgrade
Upgrade
debian/node-markdown-itto a version that resolves this vulnerability.Fixed in 10.0.0+dfsg-6 - Upgrade
Upgrade
markdown-itto a version that resolves this vulnerability.Fixed in 12.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2022-21670?
CVE-2022-21670 has a moderate severity level due to its potential to significantly slow down the parser with specific input patterns.
How do I fix CVE-2022-21670?
To fix CVE-2022-21670, upgrade to version 12.3.2 or later of the markdown-it package.
Which versions are affected by CVE-2022-21670?
Versions of markdown-it prior to 12.3.2 are affected by CVE-2022-21670.
Is there a workaround for CVE-2022-21670?
There is no known workaround for CVE-2022-21670; upgrading is the only solution.
What happens if I use input patterns longer than 50K chars in markdown-it with CVE-2022-21670?
Using input patterns longer than 50K characters can slow down the parser significantly, as highlighted by CVE-2022-21670.