Cloudanix VulnDB

CVE-2026-2327

Medium · 5.3

CVSS

5.3

EPSS

0.7%

Published

Feb 12, 2026

CISA due date

—

The record

Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.

Affected packages

Ecosystem Package Introduced Fixed
npm markdown-it 13.0.0 14.1.1
Chainguard kibana-8.17 0 8.17.10-r10
Chainguard kibana-8.17-iamguarded 0 8.17.10-r10
Chainguard kibana-8.19 0 8.19.11-r1
Chainguard kibana-8.19-bitnami 0 8.19.11-r1
Chainguard kibana-8.19-iamguarded 0 8.19.11-r1
Chainguard kibana-9.0 0 9.0.8-r10
Chainguard kibana-9.0-bitnami 0 9.0.8-r10
Chainguard kibana-9.0-iamguarded 0 9.0.8-r10
Chainguard kibana-9.1 0 9.1.10-r5
Chainguard kibana-9.1-iamguarded 0 9.1.10-r5
Chainguard kibana-9.2 0 9.2.5-r3
Chainguard kibana-9.2-iamguarded 0 9.2.5-r3
Chainguard kibana-9.3 0 9.3.0-r1
Chainguard kibana-9.3-iamguarded 0 9.3.0-r1
Chainguard renovate 0 43.25.2-r0
Chainguard vitess-22 0 22.0.3-r2
Chainguard vitess-23 0 23.0.2-r1
Wolfi renovate 0 43.25.2-r0
Wolfi vitess-22 0 22.0.3-r2
Wolfi vitess-23 0 23.0.2-r1

Related vulnerabilities