CVE-2019-25103: Regular Expression Denial of Service in simple-markdown
Summary
CVE-2019-25103: Regular Expression Denial of Service in simple-markdown. Affects simple-markdown versions < 0.5.2. Fixed in 0.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
simple-markdown is an npm package that provides a lightweight and efficient way to parse and render Markdown syntax. It is commonly used in web applications to convert Markdown text into HTML. The package is vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which can cause the application to become unresponsive or crash due to inefficient regular expression complexity.
Vulnerability Detail
The vulnerability in simple-markdown arises from inefficient regular expressions used in the code. An attacker can exploit this vulnerability remotely by providing specially crafted input that triggers the inefficient regular expression, causing the application to consume excessive CPU resources and potentially leading to a denial of service. The impact of this vulnerability can range from degraded application performance to complete unavailability.
How To Fix
Latest published version: 0.7.3 as of 23 Oct 2026
npm install simple-markdown@0.7.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.2
This is the first release that contains the fix.
npm install simple-markdown@0.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of simple-markdown to mitigate the risk.
Conclusion
The vulnerability in simple-markdown can be mitigated by upgrading to version 0.5.2 of the package. It is crucial to promptly apply the fix to prevent potential denial of service attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simple-markdown →
FAQ
simple-markdown is an npm package used for parsing and rendering Markdown syntax.
A ReDoS attack is a type of denial of service attack where an attacker provides input that causes a regular expression to take an excessive amount of time to process, leading to resource exhaustion and application unresponsiveness.
The vulnerability can be exploited remotely by an attacker sending specially crafted input to the application that triggers the inefficient regular expression, causing excessive CPU usage and potential denial of service.
The impact of this vulnerability can range from degraded application performance to complete unavailability, depending on the severity of the ReDoS attack.
Yes, upgrading to version 0.5.2 of simple-markdown fixes the vulnerability by optimizing the regular expressions and preventing ReDoS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for simple-markdown.
