A regular expression denial of service vulnerability exists in the markdown-it JavaScript library due to the use of the pattern /\*+$/ within its linkify routine. When an attacker supplies a long sequence of asterisks followed by a non‑matching character, the regex engine performs excessive backtracking which can exhaust system resources and cause the host application to become unresponsive. This weakness is classified as CWE‑1333 and can compromise the availability of any service that renders Markdown using markdown‑it without additional safeguards.

The vulnerability affects all versions of the markdown‑it package released before 14.1.1, including the version range 13.0.0 through 14.1.0. The affected product is the markdown‑it project’s library, which is commonly used in Node.js applications for Markdown parsing. Upgrading to version 14.1.1 or later resolves the issue.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. The most probable attack vector is that an attacker supplies malicious Markdown content – for example, an input field, comment feed, or API payload – that is parsed by the application. Because the flaw is in a regular expression, it does not require elevated privileges; any user who can submit data that passes through markdown‑it can trigger the denial of service.