Read the docs
TI-2026-76568 Aliases CVE-2026-111766GHSA-vfgh-jcmw-g37q

Quadratic-time denial of service in markdown-it inline HTML parsing

Priority LOW 18CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

markdown-it versions from 15.0.0 before 15.0.3 and versions before 14.3.3 are affected. When the html option or commonmark preset is enabled, repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections inside a paragraph cause the inline HTML parser to rescan overlapping input, which is an inefficient algorithmic complexity issue (CWE-407). A remote attacker who can supply Markdown for parsing can block the event loop or an unresponsive browser main thread with a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00428 37th percentileScored 2026-11-07
Fix Partial markdown-it (markdown-it): 15.0.3, 14.3.3markdown-it (npm): 14.3.3, 15.0.3Red Hat: 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
markdown-itmarkdown-it15.0.0 to before 15.0.3; before 14.3.315.0.3, 14.3.3Patch availableCNA
—markdown-it (npm)before 14.3.314.3.3Patch availableGHSA-vfgh-jcmw-g37q
—markdown-it (npm)15.0.0 to before 15.0.315.0.3Patch availableGHSA-vfgh-jcmw-g37q
  • markdown-it Vendormarkdown-it Affected 15.0.0 to before 15.0.3; before 14.3.3 Fixed in 15.0.3, 14.3.3 Patch available CNA
  • markdown-it (npm) Vendor— Affected before 14.3.3 Fixed in 14.3.3 Patch available GHSA-vfgh-jcmw-g37q
  • markdown-it (npm) Vendor— Affected 15.0.0 to before 15.0.3 Fixed in 15.0.3 Patch available GHSA-vfgh-jcmw-g37q

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:markdown-it_project:markdown-it:*:*:*:*:*:*:*:*——Markdown-it Project
  • cpe:2.3:a:markdown-it_project:markdown-it:*:*:*:*:*:*:*:* Versions — — ·Markdown-it Project

Remediation

Upgrade the npm markdown-it package to 14.3.3 for the 14.x line or to 15.0.3 for the 15.x line. Red Hat lists no available plan for Red Hat Build of Podman Desktop, Red Hat Ceph Storage 9, Red Hat Developer Hub 1, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces, and Self-service automation portal 2.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA markdown-it (markdown-it) Fixed in 15.0.3, 14.3.3
  • Fix · GHSA-vfgh-jcmw-g37q markdown-it (npm) Fixed in 14.3.3 Advisory →
  • Fix · GHSA-vfgh-jcmw-g37q markdown-it (npm) Fixed in 15.0.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Build of Podman DesktopAffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Developer Hub 1AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred
Self-service automation portal 2AffectedNo fix yet: Fix deferred
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-111766
  2. 2026-10-20 Affected versions changed · Red Hat
  3. 2026-10-20 CVSS score added · Red Hat
  4. 2026-10-21 Alias added: GHSA-vfgh-jcmw-g37q
  5. 2026-10-21 Fix available: npm/[email protected], npm/[email protected] · GHSA-vfgh-jcmw-g37q
  6. 2026-10-21 CVSS score added · GHSA-vfgh-jcmw-g37q
  7. 2026-10-21 Weakness changed · GHSA-vfgh-jcmw-g37q
  8. 2026-10-21 7 new references · GHSA-vfgh-jcmw-g37q
  9. 2026-10-21 Affected versions changed · Red Hat
  10. 2026-10-26 CISA SSVC decision points changed
  11. 2026-10-27 Affected versions changed · Red Hat

References

Advisory 1

Other 6

  • TI-2026-36071 linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop CVSS 4.0HIGH 8.7
  • TI-2026-78161 Quadratic-time parsing in markdown-it link reference definitions CVSS 3.1HIGH 7.5
  • TI-2026-76535 Quadratic time in markdown-it smartquotes causes denial of service CVSS 3.1HIGH 7.5
  • TI-2026-42701 linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text CVSS 3.1HIGH 7.5
  • TI-2025-07289 Markdown-it 14.1.0 - Cross-site scripting (XSS) CVSS 4.0MEDIUM 6.9
  • TI-2026-36244 markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations CVSS 3.1MEDIUM 5.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences