ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-111758

markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

Published Oct 20, 2026 · catalog updated Oct 22, 2026 · markdown-it: Quadratic-time rendering of

Last checked Nov 7, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-111758. EPSS is 0.55%. Act only if a listed version of markdown-it: Quadratic-time rendering of is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (markdown-it: Quadratic-time rendering of).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.55%
Remediation
Version ranges on file
Affected products
npm markdown-it

### Summary A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. It is a regression introduced by PR #1004 in 14.0.0: 13.0.2 processed a 313 KB input in 125 ms, while every version since takes about 11 seconds on the same input. At the sizes below, 200 KB takes 3.6 seconds, 400 KB takes 18.1 seconds, and 800 KB takes 74.0 seconds, which is roughly 4–5× per doubling. No options are required to trigger it. ### Details src/rules_block/reference.ts appends continuation lines with str += lineContent at lines 74, 83, 100, 133, and 150, then keeps indexing the accumulated string via str.charCodeAt(pos) in the label and whitespace loops and str.slice(...) in parseLinkTitle. V8 represents += as a cons-string, and the next charCodeAt or slice flattens it, copying everything collected so far, so one definition spanning n lines costs O(n²). Isolation confirms the rule is responsible: block-only parsing with inline disabled is still quadratic, md.disable('reference') makes the same input linear, and the same text without the leading [ is linear. The fix is to track positions in state.src instead of building str, or to collect line slices in an array and parse across them. At minimum, stop scanning the label after 999 characters (CommonMark §6.3) before pulling more lines, and cap title continuation. Add a pathological test with a 100k-line unclosed title and label. Open PR #1215 edits the same file but its label check runs after the label loop, so it does not bound either variant and the fix can land together with that PR. The observed output from PoC was: unclosed title n=100000 200009 B 3585.5 ms unclosed title n=200000 400009 B 18107.1 ms (5.05x) uncl

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm markdown-it>= 14.1.0, < 14.3.3
  • npm markdown-it>= 15.0.0, < 15.0.3

How to fix CVE-2026-111758

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-111758. EPSS is 0.55%. Act only if a listed version of markdown-it: Quadratic-time rendering of is installed.

Which versions are affected?

Compare what you have installed with >= 14.1.0, < 14.3.3, >= 15.0.0, < 15.0.3. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-400: Uncontrolled Resource Consumption; CWE-407. EPSS 0.55%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 20, 2026 · GitHub Advisory Database

    Detected

    ### Summary A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. It i

  2. Oct 20, 2026 · GitHub Advisory Database

    Updated

    ### Summary A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. It i

  3. Oct 22, 2026 · NIST NVD

    Updated

    markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so fa

Sources

  • CVE.orgVulnerability recordCVE-2026-111758

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-111758

    30-day exploitation probability 0.55%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-gfr2-rv44-r23c

    markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

    github.com
  • NIST NVDVulnerability recordCVE-2026-111758

    markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/re

    nvd.nist.gov

References

Freshness

Last verified in this catalog Nov 7, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 7, 2026
  • NIST NVDOct 22, 2026
  • CVE.orgOct 22, 2026
  • GitHub Advisory DatabaseOct 21, 2026