{"id":"EUVD-2026-105358","revision":"2aad5d1669434ea4ae8d0b0ea4309b3e","records":[{"revision":"2aad5d1669434ea4ae8d0b0ea4309b3e","observedAt":"2026-10-28T00:53:03.334+00:00","statement":{"source":"euvd","id":"EUVD-2026-105358","aliases":["CVE-2026-111758","GHSA-gfr2-rv44-r23c"],"title":"markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with …","description":"markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r23c","https://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22deaf8f1eca","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105358","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 20, 2026, 8:28:40 PM","dateUpdated":"Oct 20, 2026, 8:28:40 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-105358","identifiers":["EUVD-2026-105358","CVE-2026-111758","GHSA-gfr2-rv44-r23c"]},"retained":false,"historicalAffected":[]}],"coverage":[]}