CVE-2021-43308: Markdown link extractor Denial of Service Vulnerability
LOWCVE-2021-43308 is a LOW denial of service vulnerability (CWE-1333: Inefficient Regular Expression Complexity) affecting Markdown link extractor libraries in the npm ecosystem. The issue involves regular expression denial of service in markdown-link-extractor. Remediation is available by upgrading affected packages to version 3.0.2, 4.0.1.
CVE-2021-43308 at a Glance
How to Fix CVE-2021-43308
To remediate this vulnerability, upgrade all affected Markdown link extractor dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install markdown-link-extractor@3.0.2npm install markdown-link-extractor@4.0.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls markdown-link-extractorHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2021-43308, inspect your project dependencies using npm:
npm ls markdown-link-extractorAnalyze the terminal output to locate any version of Markdown link extractor in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.0.2), your application is affected.
Note: The npm ls markdown-link-extractor command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-1333: Inefficient Regular Expression Complexity, where the product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential. In Markdown link extractor, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2021-43308 Affected Markdown link extractor Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
markdown-link-extractor
|
npm |
< 3.0.2
|
3.0.2
|
|
markdown-link-extractor
|
npm |
≥ 4.0.0
< 4.0.1
|
4.0.1
|
References
Frequently Asked Questions
What is CVE-2021-43308?
Which Markdown link extractor versions are affected?
What version fixes CVE-2021-43308?
Is markdown-link-extractor affected?
What CWE is associated with CVE-2021-43308?
How can I check npm dependencies for CVE-2021-43308?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-mmh6-m7v9-5956",
"modified" : "2022-06-03T22:25:16Z",
"published" : "2022-06-03T00:01:00Z",
"aliases" : [ "CVE-2021-43308" ],
"summary" : "Regular expression denial of service in markdown-link-extractor",
"details" : "An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "markdown-link-extractor"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "3.0.2"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "markdown-link-extractor"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.0.0"
}, {
"fixed" : "4.0.1"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-43308"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/tcort/markdown-link-extractor"
}, {
"type" : "WEB",
"url" : "https://research.jfrog.com/vulnerabilities/markdown-link-extractor-redos-xray-211350"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-1333" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2022-06-03T22:25:16Z",
"nvd_published_at" : "2022-06-02T14:15:00Z"
}
}