CVE-2022-21670: Uncontrolled Resource Consumption in markdown-it
Impact
Special patterns with length > 50K chars can slow down parser significantly.
js const md = require('markdown-it')();
md.render(x ${' '.repeat(150000)} x \nx);
Patches
Upgrade to v12.3.2+
Workarounds
No.
References
Fix + test sample: https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101
Other sources
markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-21670?
CVE-2022-21670 has a moderate severity level due to its potential to significantly slow down the parser with specific input patterns.
How do I fix CVE-2022-21670?
To fix CVE-2022-21670, upgrade to version 12.3.2 or later of the markdown-it package.
Which versions are affected by CVE-2022-21670?
Versions of markdown-it prior to 12.3.2 are affected by CVE-2022-21670.
Is there a workaround for CVE-2022-21670?
There is no known workaround for CVE-2022-21670; upgrading is the only solution.
What happens if I use input patterns longer than 50K chars in markdown-it with CVE-2022-21670?
Using input patterns longer than 50K characters can slow down the parser significantly, as highlighted by CVE-2022-21670.