CVE-2026-111758
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
markdown-it versions 14.1.0 to before 14.3.3 and 15.0.0 to before 15.0.3 are O(n²) with default options when parsing a link reference definition whose label or title is never closed, leading to excessive resource consumption.
Risk Assessment
An attacker can submit crafted Markdown to exhaust CPU and memory (denial of service) in services that process user-supplied content.
Recommendation
Upgrade markdown-it to version 14.3.3 or 15.0.3 (or later) and limit the size and processing time of untrusted input.
Other vulnerabilities in markdown-it
See all- CVE-2026-111766Low
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.
- CVE-2026-111759High
markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, leading to denial of service. The issue occurs with many opening double quotes followed by unmatched closing single quotes.
- CVE-2026-48988Medium
markdown-it is a Markdown parser that contains a denial-of-service vulnerability in versions 14.1.1 and below when typographer: true is enabled. The issue arises from quadratic processing in the smartquotes rule, leading to excessive CPU consumption when parsing quote-heavy markdown.
Original NVD description (English source)
markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS