Key points
- Versions 14.1.0 through 14.3.2 and 15.0.0 through 15.0.2 are vulnerable to CVE-2026-111758.
- Patches are available in versions 14.3.3 and 15.0.3, fixing the quadratic complexity issue.
- The flaw allows attackers to cause denial of service via unclosed link titles or labels.
The markdown-it library contains a high severity denial of service vulnerability that affects widely used versions. Security researchers have released patches in versions 14.3.3 and 15.0.3 to address the issue.
What happened
GitHub advisory GHSA-gfr2-rv44-r23c identifies CVE-2026-111758 as a high severity flaw in the npm markdown-it package. The vulnerability affects versions 14.1.0 up to 14.3.2 and versions 15.0.0 up to 15.0.2. The issue stems from how the library processes link reference definitions with unclosed labels or titles. According to the advisory, this processing follows an O(n²) complexity pattern in version 15.0.2 with default options.
Continuation lines are pulled lazily, causing the V8 engine to flatten cons-strings repeatedly. This behaviour was introduced as a regression in version 14.0.0 via PR #1004. Testing shows that version 13.0.2 processed a 313 KB input in 125 milliseconds. Every version since then takes approximately 11 seconds for the same input. The advisory notes that 200 KB takes 3.6 seconds, while 800 KB takes 74.0 seconds. No special options are required to trigger the flaw.
Why it matters
The flaw allows an attacker to cause a denial of service by submitting malicious markdown content. The quadratic complexity means processing time increases significantly with input size. Isolation tests confirm that the block reference rule is responsible for the performance degradation. Disabling the reference rule makes the input processing linear.
The vulnerability exists because the library builds strings rather than tracking positions in the source. This causes repeated copying of accumulated data during label and title parsing. The advisory highlights that the flaw was present since version 14.0.0. It affects any system using the vulnerable versions of markdown-it with default settings.
What happens next
Users must update their markdown-it packages to the patched versions. Version 14.3.3 fixes the issue for the 14.x line. Version 15.0.3 fixes the issue for the 15.x line. The fix involves tracking positions in state.src instead of building strings. Developers should also consider capping title continuation lengths. The advisory mentions adding pathological tests for unclosed titles and labels. Open PR #1215 addresses related issues but does not bound the current variant. Teams should verify their dependencies include the patched versions.
Patch priority
Security operations teams should prioritise systems that expose markdown parsing to untrusted input. Public-facing applications accepting user-generated content require immediate attention. Internal tools with restricted input may have lower risk. Teams usually begin by identifying all instances of the vulnerable library. They then test the patch in a staging environment to ensure compatibility. Backing up current configurations before deployment is standard practice. If a patch cannot be applied immediately, limiting input size can reduce exposure. Monitoring for unusual processing times helps detect potential abuse.
What to do and how to stay safe: markdown-it
- Audit your dependencies to identify any use of vulnerable markdown-it versions.
- Update to version 14.3.3 or 15.0.3 once the vendor provides an update.
- Implement input size limits for markdown processing endpoints to mitigate impact.
- Monitor server resources for signs of excessive CPU usage during parsing.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of markdown-it are affected by this vulnerability?
Versions 14.1.0 through 14.3.2 and 15.0.0 through 15.0.2 are vulnerable.
Is there a fix available for CVE-2026-111758?
Yes, patches are available in versions 14.3.3 and 15.0.3.
How does the vulnerability cause a denial of service?
It causes quadratic complexity when processing unclosed link references, leading to excessive processing times.
