Medium severity · published Jan 10, 2022
CVE-2022-21670
Uncontrolled Resource Consumption in markdown-it
5.3
CVSS
2.3%
EPSS
No
On KEV
Description
markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
markdown-it · markdown-it
< 12.3.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-21670
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-21670
Patch
https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101
Exploit
https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6vfc-qv3f-vr6c
More from markdown-it
7.5
CVE-2026-111758
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
7.5
CVE-2026-111759
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
6.1
CVE-2025-7969
Markdown-it 14.1.0 - Cross-site scripting (XSS)
5.3
CVE-2026-48988
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
3.7
CVE-2026-111766
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled