markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.

Source published

19 Oct 2026 19:47:46 UTC

Source modified

26 Oct 2026 17:37:11 UTC

Observed here

26 Oct 2026 18:35:30 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.

Source published

Oct 19, 2026, 7:47:46 PM (timezone not stated)

Source modified

Oct 26, 2026, 5:37:11 PM (timezone not stated)

Observed here

7 Nov 2026 04:33:00 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.

Source published

19 Oct 2026 20:17:52 UTC

Source modified

26 Oct 2026 18:17:36 UTC

Observed here

27 Oct 2026 05:23:41 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

### Summary With `html: true`, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments (`<!--`), processing instructions (`<?`), declarations (`<!A`), and CDATA sections (`<![CDATA[`). An attacker-controlled input of a few hundred kilobytes can block the Node.js event loop for seconds or tens of seconds. The default configuration has HTML disabled, but the `commonmark` preset enables it. The issue was reported against the published `[email protected]` package on Node.js 20 and reproduced on the current source with Node.js 24.16.0. ### Details `src/rules_inline/text.ts` treats `<` as a terminator, causing the inline parser to attempt the HTML rule at successive HTML construct openers. With HTML enabled, `src/rules_inline/html_inline.ts` applies an anchored regular expression to the remaining input: ```js const match = state.src.slice(pos).match(HTML_TAG_RE) ``` The comment, processing instruction, declaration, and CDATA alternatives in `src/common/html_re.ts` scan the remaining input for their respective terminators: `-->`, `?>`, `>`, and `]]>`. When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again. Repeating this across the paragraph produces quadratic total work. For these inputs, the problem is repeated scanning across separate matches. The payload must reach inline parsing. Prefixing it with `x ` keeps it inside a paragraph. Starting a line directly with one of these constructs instead invokes HTML block parsing, which does not exhibit the same repeated inline scans for these payloads. The existing `unclosed <!--` test in `test/markdown-it/pathological.test.mjs` already contains a reproducer: ```js '</' + '<!--'.repeat(100000) ``` However, it runs with default options, where HTML is disabled. A fix should avoid repeated searches for absent terminators across all four affected alternatives, for example by caching failed searches on the inline state. Fixing only the comment alternative leaves the other three cases affected. Regression coverage should exercise all four with `html: true`. The original report was submitted by [@JarLob](https://github.com/JarLob). It credits the [GitHub Security Lab Taskflow Agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent) as part of the [GitHub Secure Open Source Fund](https://github.com/open-source/github-secure-open-source-fund). ### Proof of concept Install the affected package in an empty directory: ```sh npm install [email protected] ``` Save the following as `poc.mjs` and run `node poc.mjs`: ```js import MarkdownIt from 'markdown-it' import { performance } from 'node:perf_hooks' const mdHtml = new MarkdownIt({ html: true }) const mdDefault = new MarkdownIt() const sizes = [8000, 16000, 32000, 64000] function measure(md, src) { const start = performance.now() md.render(src) return (performance.now() - start).toFixed(1) } const variants = { comment: '<!--', processing: '<?x', declaration: '<!A', cdata: '<![CDATA[' } for (const [name, opener] of Object.entries(variants)) { console.log(`\n${name}`) for (const n of sizes) { const src = 'x ' + opener.repeat(n) console.log({ n, bytes: Buffer.byteLength(src), ms: measure(mdHtml, src) }) } } const n = sizes.at(-1) const controls = { 'HTML disabled': [mdDefault, 'x ' + '<!--'.repeat(n)], 'Closed comments': [mdHtml, 'x ' + '<!---->'.repeat(n)], 'HTML block': [mdHtml, '<!--'.repeat(n)], 'Plain text': [mdHtml, 'x ' + 'abcd'.repeat(n)] } for (const [name, [md, src]] of Object.entries(controls)) { console.log({ control: name, ms: measure(md, src) }) } const repoPayload = '</' + '<!--'.repeat(100000) console.log({ payload: 'Existing pathological test', htmlFalseMs: measure(mdDefault, repoPayload), htmlTrueMs: measure(mdHtml, repoPayload) }) ``` Measurements from the original report on `[email protected]`, Node.js 20: | Construct | 8,000 repetitions | 64,000 repetitions | | --- | ---: | ---: | | Comment | 170 ms | 8,799 ms | | Processing instruction | 26 ms | 1,566 ms | | Declaration | 93 ms | 5,628 ms | | CDATA | 119 ms | 4,179 ms | An eightfold increase in repetitions produces approximately 35–60 times the execution time, consistent with quadratic growth becoming dominant. For the comment payload at 64,000 repetitions: - HTML disabled: 25 ms. - Closed comments: 29 ms. - Payload at the start of an HTML block: 1 ms. - Plain text: 1 ms. The existing pathological-test payload with 100,000 comment openers took 33 ms with HTML disabled and 21,030 ms with HTML enabled. A separate comment payload with 128,000 repetitions, approximately 500 KiB, took 32,847 ms. Exact timings depend on the runtime and hardware. ### Impact This is an availability issue affecting applications that render attacker-controlled Markdown with `html: true`, including applications using the `commonmark` preset. On Node.js, a synchronous `render()` call can occupy a CPU core and block the event loop for seconds or tens of seconds, delaying other requests handled by the same process. Repeated submissions can cause denial of service. Browser applications can similarly become unresponsive when rendering on the main thread. Sanitizing the generated HTML afterwards does not prevent the issue because the expensive processing occurs during Markdown rendering. The default configuration, with HTML disabled, is unaffected by these payloads. Disabling HTML or limiting input size can reduce exposure while a fix is prepared. The reported affected release is `15.0.2`; the full affected version range has not been established.

Source published

20 Oct 2026 20:08:19 UTC

Source modified

20 Oct 2026 20:15:05 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Publisher rating · LOW