Medium severity5.9NVD Advisory· Published Jun 2, 2022· Updated Jun 17, 2026
CVE-2021-43308
CVE-2021-43308
Description
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
markdown-link-extractornpm | < 3.0.2 | 3.0.2 |
markdown-link-extractornpm | >= 4.0.0, < 4.0.1 | 4.0.1 |
Affected products
3cpe:2.3:a:markdown-link-extractor_project:markdown-link-extractor:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:markdown-link-extractor_project:markdown-link-extractor:*:*:*:*:*:node.js:*:*range: <3.0.2
- cpe:2.3:a:markdown-link-extractor_project:markdown-link-extractor:4.0.0:*:*:*:*:node.js:*:*
Patches
Vulnerability mechanics
References
4- research.jfrog.com/vulnerabilities/markdown-link-extractor-redos-xray-211350/nvdExploitThird Party Advisory
- github.com/advisories/GHSA-mmh6-m7v9-5956ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-43308ghsaADVISORY
- research.jfrog.com/vulnerabilities/markdown-link-extractor-redos-xray-211350ghsaWEB
News mentions
0No linked articles in our index yet.