markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111758 · Microsoft / collected KEV context

EUVD-2026-105358

GHSA-gfr2-rv44-r23c

cve-program · CVE-2026-111758

• https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r23c
• https://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22deaf8f1eca
• https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503
• https://github.com/markdown-it/markdown-it/releases/tag/14.3.3
• https://github.com/markdown-it/markdown-it/releases/tag/15.0.3

euvd · EUVD-2026-105358

• https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r23c
• https://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22deaf8f1eca
• https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503
• https://github.com/markdown-it/markdown-it/releases/tag/14.3.3
• https://github.com/markdown-it/markdown-it/releases/tag/15.0.3

nvd · CVE-2026-111758

• https://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22deaf8f1eca
• https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503
• https://github.com/markdown-it/markdown-it/releases/tag/14.3.3
• https://github.com/markdown-it/markdown-it/releases/tag/15.0.3
• https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r23c

osv · GHSA-gfr2-rv44-r23c

• https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r23c
• https://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22deaf8f1eca
• https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503
• https://github.com/markdown-it/markdown-it
• https://github.com/markdown-it/markdown-it/releases/tag/14.3.3
• https://github.com/markdown-it/markdown-it/releases/tag/15.0.3

No related operational record is retained in the current change model.