CVE-2026-111758 · GHSA-gfr2-rv44-r23c
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
- Risk score
- 68/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- markdown-it has a quadratic-time rendering vulnerability in link reference definitions, allowing an attacker to cause a denial of service (DoS). An attacker could exploit this vulnerability to cause a denial of service.
- Affected
- {'products': ['markdown-it'], 'packages': [{'ecosystem': 'npm', 'name': 'markdown-it', 'vulnerable': '>= 14.1.0, < 14.3.3'}, {'ecosystem': 'npm', 'name': 'markdown-it', 'vulnerable': '>= 15.0.0, < 15.0.3'}], 'versions': ['14.1.0 - 14.3.3', '15.0.0 - 15.0.3']}
- Fix
- Upgrade to version 14.3.3 or 15.0.3
- Exploitation
- Public proof of concept
Story map
At a glance
markdown-it: Amber, patch this week. markdown-it has a quadratic-time rendering vulnerability in link reference definitions, allowing an attacker to cause a denial of service (DoS). An attacker could exploit this vulnerability to cause a denial of service.
The flaws
- CVE-2026-111758: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) (CVSS 7.5 · EPSS 0%)
- CVE-2026-111759: Quadratic complexity in smartquotes with unmatched closing quotes (CVSS 7.5 · EPSS 1%)
- GHSA-253c-mchw-3w2r: Markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds (CVSS 6.3)
The fix
Upgrade markdown-it: 14.3.3 · 15.0.0 · 15.0.3 · 14.3.2 · 15.0.2 or later on your release line
Who is exposed: {'products': ['markdown-it'], 'packages': [{'ecosystem': 'npm', 'name': 'markdown-it', 'vulnerable': '>= 14.1.0, < 14.3.3'}, {'ecosystem': 'npm', 'name': 'markdown-it', 'vulnerable': '>= 15.0.0, < 15.0.3'}], 'versions': ['14.1.0 - 14.3.3', '15.0.0 - 15.0.3']}
Where it stands
- Public proof of concept
Connects to
- Same weakness: Denial of service (CWE-400). 254 other warnings in 30 days
Why it is Amber
- CVSS 7.5 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| markdown-it | npm | >= 14.1.0, < 14.3.3 | 14.3.3 |
| markdown-it | npm | >= 15.0.0, < 15.0.3 | 15.0.3 |
References
- https://github.com/advisories/GHSA-gfr2-rv44-r23c
- https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r23c
- https://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22deaf8f1eca
- https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503
- https://github.com/markdown-it/markdown-it/releases/tag/14.3.3
- https://github.com/markdown-it/markdown-it/releases/tag/15.0.3
- https://github.com/advisories/GHSA-gfr2-rv44-r23c
Original description
markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.
Last activity 20 Oct 2026. Patch Forecast updates every hour.