{"id":"GHSA-vfgh-jcmw-g37q","revision":null,"records":[{"revision":"eb08345bfbfa4572b850b6629f961815","observedAt":"2026-10-26T18:35:30.824+00:00","statement":{"source":"cve-program","id":"CVE-2026-111766","aliases":[],"title":"markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled","description":"markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.","state":0,"publishedAt":"2026-10-19T19:47:46.488+00:00","modifiedAt":"2026-10-26T17:37:11.818+00:00","affected":[{"ecosystem":"Vendor product","name":"markdown-it","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"markdown-it\",\n                    \"product\": \"markdown-it\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 15.0.0, < 15.0.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"< 14.3.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","score":3.7,"severity":"LOW"}],"references":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q","https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111766","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-111766","identifiers":["CVE-2026-111766"]},"retained":false,"historicalAffected":[]},{"revision":"5aeb62f72c65400abe66d4f28e86295a","observedAt":"2026-11-07T04:33:00.286+00:00","statement":{"source":"euvd","id":"EUVD-2026-104595","aliases":["CVE-2026-111766","GHSA-vfgh-jcmw-g37q"],"title":"markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML commen…","description":"markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","score":3.7,"severity":null}],"references":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q","https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-104595","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 19, 2026, 7:47:46 PM","dateUpdated":"Oct 26, 2026, 5:37:11 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-104595","identifiers":["EUVD-2026-104595","CVE-2026-111766","GHSA-vfgh-jcmw-g37q"]},"retained":false,"historicalAffected":[]},{"revision":"0a2a9157037649998f163baa817b4787","observedAt":"2026-10-27T05:23:41.411+00:00","statement":{"source":"nvd","id":"CVE-2026-111766","aliases":[],"title":"markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML commen…","description":"markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.","state":0,"publishedAt":"2026-10-19T20:17:52.247+00:00","modifiedAt":"2026-10-26T18:17:36.273+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","score":3.7,"severity":"LOW"}],"references":["https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111766","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-400","CWE-407"],"productCriteria":[],"sourceDates":{"published":"2026-10-19T20:17:52.247","lastModified":"2026-10-26T18:17:36.273"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-111766","identifiers":["CVE-2026-111766"]},"retained":false,"historicalAffected":[]},{"revision":"eec4f7266cde44109aafa651a3fe2063","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-vfgh-jcmw-g37q","aliases":["CVE-2026-111766"],"title":"markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled","description":"### Summary\n\nWith `html: true`, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments (`<!--`), processing instructions (`<?`), declarations (`<!A`), and CDATA sections (`<![CDATA[`).\n\nAn attacker-controlled input of a few hundred kilobytes can block the Node.js event loop for seconds or tens of seconds. The default configuration has HTML disabled, but the `commonmark` preset enables it.\n\nThe issue was reported against the published `markdown-it@15.0.2` package on Node.js 20 and reproduced on the current source with Node.js 24.16.0.\n\n### Details\n\n`src/rules_inline/text.ts` treats `<` as a terminator, causing the inline parser to attempt the HTML rule at successive HTML construct openers.\n\nWith HTML enabled, `src/rules_inline/html_inline.ts` applies an anchored regular expression to the remaining input:\n\n```js\nconst match = state.src.slice(pos).match(HTML_TAG_RE)\n```\n\nThe comment, processing instruction, declaration, and CDATA alternatives in `src/common/html_re.ts` scan the remaining input for their respective terminators: `-->`, `?>`, `>`, and `]]>`.\n\nWhen the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again. Repeating this across the paragraph produces quadratic total work. For these inputs, the problem is repeated scanning across separate matches.\n\nThe payload must reach inline parsing. Prefixing it with `x ` keeps it inside a paragraph. Starting a line directly with one of these constructs instead invokes HTML block parsing, which does not exhibit the same repeated inline scans for these payloads.\n\nThe existing `unclosed <!--` test in `test/markdown-it/pathological.test.mjs` already contains a reproducer:\n\n```js\n'</' + '<!--'.repeat(100000)\n```\n\nHowever, it runs with default options, where HTML is disabled.\n\nA fix should avoid repeated searches for absent terminators across all four affected alternatives, for example by caching failed searches on the inline state. Fixing only the comment alternative leaves the other three cases affected. Regression coverage should exercise all four with `html: true`.\n\nThe original report was submitted by [@JarLob](https://github.com/JarLob). It credits the [GitHub Security Lab Taskflow Agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent) as part of the [GitHub Secure Open Source Fund](https://github.com/open-source/github-secure-open-source-fund).\n\n### Proof of concept\n\nInstall the affected package in an empty directory:\n\n```sh\nnpm install markdown-it@15.0.2\n```\n\nSave the following as `poc.mjs` and run `node poc.mjs`:\n\n```js\nimport MarkdownIt from 'markdown-it'\nimport { performance } from 'node:perf_hooks'\n\nconst mdHtml = new MarkdownIt({ html: true })\nconst mdDefault = new MarkdownIt()\nconst sizes = [8000, 16000, 32000, 64000]\n\nfunction measure(md, src) {\n  const start = performance.now()\n  md.render(src)\n  return (performance.now() - start).toFixed(1)\n}\n\nconst variants = {\n  comment: '<!--',\n  processing: '<?x',\n  declaration: '<!A',\n  cdata: '<![CDATA['\n}\n\nfor (const [name, opener] of Object.entries(variants)) {\n  console.log(`\\n${name}`)\n  for (const n of sizes) {\n    const src = 'x ' + opener.repeat(n)\n    console.log({\n      n,\n      bytes: Buffer.byteLength(src),\n      ms: measure(mdHtml, src)\n    })\n  }\n}\n\nconst n = sizes.at(-1)\nconst controls = {\n  'HTML disabled': [mdDefault, 'x ' + '<!--'.repeat(n)],\n  'Closed comments': [mdHtml, 'x ' + '<!---->'.repeat(n)],\n  'HTML block': [mdHtml, '<!--'.repeat(n)],\n  'Plain text': [mdHtml, 'x ' + 'abcd'.repeat(n)]\n}\n\nfor (const [name, [md, src]] of Object.entries(controls)) {\n  console.log({ control: name, ms: measure(md, src) })\n}\n\nconst repoPayload = '</' + '<!--'.repeat(100000)\nconsole.log({\n  payload: 'Existing pathological test',\n  htmlFalseMs: measure(mdDefault, repoPayload),\n  htmlTrueMs: measure(mdHtml, repoPayload)\n})\n```\n\nMeasurements from the original report on `markdown-it@15.0.2`, Node.js 20:\n\n| Construct | 8,000 repetitions | 64,000 repetitions |\n| --- | ---: | ---: |\n| Comment | 170 ms | 8,799 ms |\n| Processing instruction | 26 ms | 1,566 ms |\n| Declaration | 93 ms | 5,628 ms |\n| CDATA | 119 ms | 4,179 ms |\n\nAn eightfold increase in repetitions produces approximately 35–60 times the execution time, consistent with quadratic growth becoming dominant.\n\nFor the comment payload at 64,000 repetitions:\n\n- HTML disabled: 25 ms.\n- Closed comments: 29 ms.\n- Payload at the start of an HTML block: 1 ms.\n- Plain text: 1 ms.\n\nThe existing pathological-test payload with 100,000 comment openers took 33 ms with HTML disabled and 21,030 ms with HTML enabled. A separate comment payload with 128,000 repetitions, approximately 500 KiB, took 32,847 ms.\n\nExact timings depend on the runtime and hardware.\n\n### Impact\n\nThis is an availability issue affecting applications that render attacker-controlled Markdown with `html: true`, including applications using the `commonmark` preset.\n\nOn Node.js, a synchronous `render()` call can occupy a CPU core and block the event loop for seconds or tens of seconds, delaying other requests handled by the same process. Repeated submissions can cause denial of service. Browser applications can similarly become unresponsive when rendering on the main thread.\n\nSanitizing the generated HTML afterwards does not prevent the issue because the expensive processing occurs during Markdown rendering.\n\nThe default configuration, with HTML disabled, is unaffected by these payloads. Disabling HTML or limiting input size can reduce exposure while a fix is prepared.\n\nThe reported affected release is `15.0.2`; the full affected version range has not been established.","state":0,"publishedAt":"2026-10-20T20:08:19+00:00","modifiedAt":"2026-10-20T20:15:05.2200392+00:00","affected":[{"ecosystem":"npm","name":"markdown-it","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"14.3.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"markdown-it","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"15.0.0"},{"kind":"fixed","version":"15.0.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q","https://nvd.nist.gov/vuln/detail/CVE-2026-111766","https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"],"sourceUrl":"https://github.com/advisories/GHSA-vfgh-jcmw-g37q","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vfgh-jcmw-g37q","identifiers":["GHSA-vfgh-jcmw-g37q","CVE-2026-111766"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T17:07:37.1829709+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T17:07:37.1829709+00:00","lastSuccessAt":"2026-11-07T17:07:37.3549159+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:07:37.3549172+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-715e663378e343ca50c7397586f2d227eca3ece57a7a73d5f48eaadc71eb9f69","complete":true,"records":420933,"lastAttemptAt":"2026-11-07T17:07:36.095653+00:00","lastSuccessAt":"2026-11-07T17:07:36.0305426+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:07:36.095653+00:00","snapshotPublishedAt":"2026-11-07T16:30:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ce98ec71edc04bf7b5b5ed5b4106954c","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T17:19:56.3581416+00:00","lastSuccessAt":"2026-11-07T17:19:56.354+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:19:56.354+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T17:07:37.1829709+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T17:07:37.1829709+00:00","lastSuccessAt":"2026-11-07T17:07:37.3564231+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:07:37.3564236+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-57173bad19094db6a6a9d0334caa764d","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T17:08:02.7189692+00:00","lastSuccessAt":"2026-11-07T17:08:02.715+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:08:02.715+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T17:07:36.7559298+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:07:36.7559298+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T17:07:36.1583672+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:07:36.1583672+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T17:07:37.135444+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:07:37.135444+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T17:07:36.637447+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:07:36.637447+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}