CVE-2026-2327: 
JavaScript vulnerability analysis and mitigation

CVE-2026-2327 is a Regular Expression Denial of Service (ReDoS) vulnerability in the markdown-it npm package, affecting versions 13.0.0 through 14.1.0 (i.e., before 14.1.1). The flaw resides in the linkify inline rule, where the regex /\*+$/ is used to strip trailing asterisks from URLs — a pattern susceptible to catastrophic backtracking when fed specially crafted input. The vulnerability was originally reported by researcher Duc Le Trung (ltduc147) and disclosed on February 12, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 5.5 (Medium) (Red Hat CVE, Snyk).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity). The vulnerable code is located in markdown-it/lib/rules_inline/linkify.mjs, where the expression /\*+$/ is applied to strip trailing asterisk characters from detected URLs. Because this regex uses a greedy quantifier anchored to the end of the string, a JavaScript regex engine must perform exponential backtracking when given a long sequence of * characters followed by a non-matching character (e.g., https://test.com? + *.repeat(N) + a). The attack is network-accessible, requires no authentication or user interaction, and is only triggered when the linkify: true option is enabled. A public proof-of-concept demonstrating the issue is available (GitHub Gist, GitHub Commit).

Successful exploitation causes excessive CPU consumption in the Node.js process rendering the markdown, leading to application hangs and denial-of-service conditions. The impact is limited entirely to availability — there is no confidentiality or integrity impact, and no data exfiltration or lateral movement is possible through this vulnerability alone. Any application that accepts user-supplied markdown input and renders it with markdown-it configured with linkify: true is at risk of being rendered unresponsive (Snyk, Red Hat Bugzilla).

A public proof-of-concept exploit exists as a GitHub Gist published by the original reporter, demonstrating measurable processing delays with inputs as short as tens of thousands of asterisk characters (GitHub Gist). Snyk classifies the exploit maturity as "Proof of Concept." There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.013% (6th percentile), indicating a low probability of active exploitation (Snyk). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify target: Locate a web application or service that accepts user-supplied markdown input and renders it server-side using markdown-it with the linkify: true option enabled, running versions 13.0.0–14.1.0.
2. Craft malicious payload: Construct an input string containing a URL-like prefix followed by a large number of asterisk characters and a trailing non-matching character, e.g.:

   https://test.com?<repeated '*' characters (e.g., 100,000)>a

3. Submit payload: Send the crafted string as markdown input to the target application (e.g., via a comment field, document editor, or API endpoint that processes markdown).
4. Trigger ReDoS: The linkify rule in markdown-it applies the regex /\*+$/ to the detected URL, causing the JavaScript regex engine to perform catastrophic backtracking proportional to the number of asterisks.
5. Achieve denial of service: The server-side Node.js process becomes CPU-bound processing the regex, causing the application to hang or become unresponsive to other requests (GitHub Gist, Snyk).

• Application Behavior: Sudden, sustained CPU spikes in Node.js processes handling markdown rendering; application threads becoming unresponsive or timing out during markdown processing.
• Logs: Requests containing unusually long strings with repetitive * characters in input fields that feed into markdown rendering pipelines; HTTP requests with abnormally large payloads directed at markdown-processing endpoints.
• Process: Node.js worker processes consuming near 100% CPU for extended periods without completing; event loop lag metrics spiking in application performance monitoring tools.
• Network: Repeated submissions of large payloads (tens to hundreds of kilobytes of asterisk characters) from the same source IP to markdown-rendering endpoints.

The primary remediation is to upgrade markdown-it to version 14.1.1 or later, which replaces the vulnerable regex with a manual character-by-character backsearch that avoids catastrophic backtracking (GitHub Commit). For systems that cannot patch immediately, consider disabling the linkify option (linkify: false) in markdown-it configuration, as the vulnerable code path is only triggered when linkification is enabled. Additionally, implement input length validation or rate limiting on endpoints that accept and render user-supplied markdown to reduce exposure. IBM has released updated advisories for affected products including IBM API Connect, IBM Cloud Pak for Automation, IBM Business Automation Workflow, IBM MQ Operator, and others (IBM Advisory).

Red Hat tracked the vulnerability via Bugzilla with medium severity and assigned it to their Product Security DevOps Team, with multiple downstream Red Hat products listed as dependencies (Red Hat Bugzilla). IBM issued multiple security bulletins across a broad range of enterprise products that bundle markdown-it, including API Connect, Cloud Pak for Automation, Business Automation Workflow, MQ Operator, and Instana Observability (IBM Advisory). Snyk published a detailed vulnerability entry crediting researcher Duc Le Trung and classifying the exploit maturity as proof-of-concept (Snyk). The NetBox community also opened a tracking issue to address the dependency (GitHub Issue).