Skip to content
OpenAdvisories
High · 7.5 CVE-2026-111758 EUVD-2026-105358GHSA-gfr2-rv44-r23c

markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

Published Oct 20, 2026 · Updated Oct 28, 2026 · Assigned by GitHub_M

Description

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.

Affected products

VendorProductAffectedFixed
markdown-it markdown-it >= 14.1.0, < 14.3.3, >= 15.0.0, < 15.0.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 26.10 node-markdown-it No fix yet —
Ubuntu 26.04 LTS node-markdown-it No fix yet —
Ubuntu 24.04 LTS node-markdown-it No fix yet —
Ubuntu 22.04 LTS node-markdown-it No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling renovate 44.176.1-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm markdown-it >= 14.1.0, < 14.3.3 14.3.3 GHSA-gfr2-rv44-r23c
npm markdown-it >= 15.0.0, < 15.0.3 15.0.3 GHSA-gfr2-rv44-r23c

References