{"id":"EUVD-2026-105358","enisaUuid":"dc60fadf-bdc7-330c-be08-d868f1fd7c5a","description":"markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str +\u003d lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.","datePublished":"Oct 20, 2026, 8:28:40 PM","dateUpdated":"Oct 20, 2026, 8:28:40 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r23c\nhttps://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22deaf8f1eca\nhttps://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503\nhttps://github.com/markdown-it/markdown-it/releases/tag/14.3.3\nhttps://github.com/markdown-it/markdown-it/releases/tag/15.0.3\n","aliases":"CVE-2026-111758\nGHSA-gfr2-rv44-r23c\n","assigner":"GitHub_M","epss":0.46,"enisaIdProduct":[{"id":"41f9f4ce-eea0-3810-84dc-12aef44b67fc","product":{"name":"markdown-it","vendor":{"name":"markdown-it"}},"product_version":"15.0.0, \u003c 15.0.3"},{"id":"bc948c41-64fe-3074-8e64-38dd9bcd84bc","product":{"name":"markdown-it","vendor":{"name":"markdown-it"}},"product_version":"14.1.0, \u003c 14.3.3"}],"enisaIdVendor":[{"id":"1b0abc2f-9b00-39fc-ba03-94d6c375465b","vendor":{"name":"markdown-it"}}],"enisaIdVulnerability":[{"id":"2f4f8bd8-28c3-34eb-82d8-b199abe51b37","vulnerability":{"id":"CVE-2026-111758","description":"markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str +\u003d lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.","datePublished":"Oct 20, 2026, 8:28:40 PM","dateUpdated":"Oct 20, 2026, 8:28:40 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r23c\nhttps://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22deaf8f1eca\nhttps://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503\nhttps://github.com/markdown-it/markdown-it/releases/tag/14.3.3\nhttps://github.com/markdown-it/markdown-it/releases/tag/15.0.3\n","enisa_id":"EUVD-2026-105358\n","assigner":"GitHub_M","epss":0.46,"dataProcessed":"Oct 27, 2026, 7:14:40 AM","vulnerabilityProduct":[{"id":"b49c2158-a2cb-342d-9d37-84cdb55122f0","product":{"name":"markdown-it","vendor":{"name":"markdown-it"}},"product_version":"15.0.0, \u003c 15.0.3"},{"id":"d657137c-987b-3952-b209-be21f27544fa","product":{"name":"markdown-it","vendor":{"name":"markdown-it"}},"product_version":"14.1.0, \u003c 14.3.3"}],"vulnerabilityVendor":[{"id":"ffb8d93f-f8b0-3250-a363-9c18b0437833","vendor":{"name":"markdown-it"}}]}},{"id":"7a20585d-eea5-302e-8eb3-990edf684e10","vulnerability":{"id":"GHSA-gfr2-rv44-r23c","description":"markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)","datePublished":"Oct 20, 2026, 8:28:44 PM","dateUpdated":"Oct 20, 2026, 8:28:44 PM","baseScore":0.0,"references":"https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r23c\nhttps://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22deaf8f1eca\nhttps://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503\nhttps://github.com/markdown-it/markdown-it\nhttps://github.com/markdown-it/markdown-it/releases/tag/14.3.3\nhttps://github.com/markdown-it/markdown-it/releases/tag/15.0.3\n","enisa_id":"EUVD-2026-105358\n","aliases":"GHSA-gfr2-rv44-r23c\nCVE-2026-111758\n","epss":0.0,"dataProcessed":"Oct 27, 2026, 7:03:17 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}