CVE-2019-25102: Regular Expression Denial of Service in simple-markdown
Summary
CVE-2019-25102: Regular Expression Denial of Service in simple-markdown. Affects simple-markdown versions < 0.6.1. Fixed in 0.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
simple-markdown is an npm package that provides a lightweight and efficient way to parse and render Markdown syntax. It is widely used in web applications to convert Markdown text into HTML for display. However, a vulnerability has been discovered in version 0.6.0 of simple-markdown, which can be exploited remotely to cause a denial of service (DoS) attack. The vulnerability arises from inefficient regular expression complexity when processing certain input patterns. This issue has been assigned the identifier CVE-2019-25102.
Vulnerability Detail
The vulnerability in simple-markdown version 0.6.0 allows an attacker to exploit the inefficient regular expression complexity and launch a remote DoS attack. By providing specially crafted input, such as '<<<<<<<<<<:/:/:/:/:/:/:/:/', the regular expression engine can be overwhelmed, causing the application to consume excessive CPU resources and become unresponsive. This can lead to a complete denial of service for legitimate users. The exploit has been publicly disclosed, increasing the risk of attacks. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 0.7.3 as of 23 Oct 2026
npm install simple-markdown@0.7.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.1
This is the first release that contains the fix.
npm install simple-markdown@0.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of simple-markdown to protect the application from potential attacks.
Conclusion
The vulnerability in simple-markdown version 0.6.0 can be exploited remotely to cause a denial of service attack. To mitigate this risk, it is crucial to upgrade to version 0.6.1 of simple-markdown, which includes the necessary fixes. Failure to address this vulnerability may result in application downtime and potential disruption to users. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simple-markdown →
FAQ
simple-markdown is an npm package used for parsing and rendering Markdown syntax in web applications.
The vulnerability allows remote attackers to launch a DoS attack, causing the application to become unresponsive and denying service to legitimate users.
To fix this vulnerability, upgrade the simple-markdown package to version 0.6.1, which includes the necessary patches.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for simple-markdown.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
