CVE-2026-111758

Name of the Vulnerable Software and Affected Versions markdown-it versions 14.1.0 through 14.3.2 markdown-it versions 15.0.0 through 15.0.2

Description An algorithmic-complexity denial of service exists when processing a link reference definition with a label or title that is never closed. Using default options, continuation lines are pulled lazily in src/rules block/reference.ts using str += lineContent. Subsequent calls to charCodeAt and slice flatten the V8 cons-string, causing the process to copy all collected data repeatedly. This results in O(n²) time complexity, where the processing time increases quadratically relative to the input size. For example, a 400 KB request can block the Node.js event loop for approximately 18 seconds, while an 800 KB request can block it for about 74 seconds.

Recommendations Update markdown-it to version 14.3.3. Update markdown-it to version 15.0.3.