GHSA-j95f-988m-3j2f

High

Published: —Translated: 22/10/2026(UTC)NVD NIST

Summary

@tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated __QUOTED_0 prefixes. Inline shortcode attributes use another unanchored expression, which can lead to resource exhaustion.

Risk Assessment

An attacker can remotely cause high CPU usage and increased application response times, leading to denial of service (DoS). The vulnerability affects applications using @tiptap/core for Markdown processing.

Recommendation

Update the @tiptap/core library to a version containing the fix (refer to GHSA-j95f-988m-3j2f). If updating is not possible, limit or delay processing of untrusted Markdown input.

Other vulnerabilities in @tiptap/core

GHSA-cp6q-959q-f8rhMedium
@tiptap/core's public mergeAttributes() helper uses ordinary bracket assignment on keys returned by Object.entries(). An own __proto__ key from JSON therefore invokes the legacy prototype setter on the fresh merged object, and the function returns an object whose prototype is attacker-controlled.

Original NVD description (English source)

## Summary `@tiptap/core` contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated `__QUOTED_0` prefixes. Inline shortcode attributes use another unanchored g

Vulnerability data from NVD (NIST) · CISA KEV · EPSS