GHSA-38c4-r59v-3vqw
Medium · 5.3CVSS
5.3
EPSS
—
Published
Feb 12, 2026
CISA due date
—
The record
markdown-it is has a Regular Expression Denial of Service (ReDoS)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | markdown-it | 13.0.0 | 14.1.1 |
| Chainguard | kibana-8.17 | 0 | 8.17.10-r10 |
| Chainguard | kibana-8.17-iamguarded | 0 | 8.17.10-r10 |
| Chainguard | kibana-8.19 | 0 | 8.19.11-r1 |
| Chainguard | kibana-8.19-bitnami | 0 | 8.19.11-r1 |
| Chainguard | kibana-8.19-iamguarded | 0 | 8.19.11-r1 |
| Chainguard | kibana-9.0 | 0 | 9.0.8-r10 |
| Chainguard | kibana-9.0-bitnami | 0 | 9.0.8-r10 |
| Chainguard | kibana-9.0-iamguarded | 0 | 9.0.8-r10 |
| Chainguard | kibana-9.1 | 0 | 9.1.10-r5 |
| Chainguard | kibana-9.1-iamguarded | 0 | 9.1.10-r5 |
| Chainguard | kibana-9.2 | 0 | 9.2.5-r3 |
| Chainguard | kibana-9.2-iamguarded | 0 | 9.2.5-r3 |
| Chainguard | kibana-9.3 | 0 | 9.3.0-r1 |
| Chainguard | kibana-9.3-iamguarded | 0 | 9.3.0-r1 |
| Chainguard | renovate | 0 | 43.25.2-r0 |
| Chainguard | vitess-22 | 0 | 22.0.3-r2 |
| Chainguard | vitess-23 | 0 | 23.0.2-r1 |
| Wolfi | renovate | 0 | 43.25.2-r0 |
| Wolfi | vitess-22 | 0 | 22.0.3-r2 |
| Wolfi | vitess-23 | 0 | 23.0.2-r1 |
Related vulnerabilities
- CVE-2026-2327 Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to… Same vulnerability
- CVE-2026-48988 markdown-it is a Markdown parser. Also affects markdown-it
- GHSA-6v5v-wf23-fmfq markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations Also affects markdown-it
- GHSA-7rx3-28cr-v5wh Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__… Also affects kibana-8.17
- GHSA-442j-39wm-28r2 Handlebars.js has a Property Access Validation Bypass in container.lookup Also affects kibana-8.17
- CVE-2026-33940 Handlebars provides the power necessary to let users build semantic templates. Also affects kibana-8.17
- CVE-2026-33941 Handlebars provides the power necessary to let users build semantic templates. Also affects kibana-8.17
- CVE-2026-33939 Handlebars provides the power necessary to let users build semantic templates. Also affects kibana-8.17