Read the docs
TI-2026-78161 Aliases CVE-2026-111758GHSA-gfr2-rv44-r23c

Quadratic-time parsing in markdown-it link reference definitions

Priority HIGH 72CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

markdown-it versions from 14.1.0 before 14.3.3 and from 15.0.0 before 15.0.3 are affected. A link reference definition with an unclosed label or title takes quadratic time to process with default options, because continuation lines are concatenated inefficiently (CWE-407). A remote unauthenticated attacker can make the parser consume excessive CPU and stall the service that renders Markdown.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0055 46th percentileScored 2026-11-07
Fix Partial markdown-it (markdown-it): 14.3.3, 15.0.3markdown-it (npm): 14.3.3, 15.0.3Red Hat: 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
markdown-itmarkdown-it14.1.0 to before 14.3.3; 15.0.0 to before 15.0.314.3.3, 15.0.3Patch availableCNA
—markdown-it (npm)14.1.0 to before 14.3.314.3.3Patch availableGHSA-gfr2-rv44-r23c
—markdown-it (npm)15.0.0 to before 15.0.315.0.3Patch availableGHSA-gfr2-rv44-r23c
  • markdown-it Vendormarkdown-it Affected 14.1.0 to before 14.3.3; 15.0.0 to before 15.0.3 Fixed in 14.3.3, 15.0.3 Patch available CNA
  • markdown-it (npm) Vendor— Affected 14.1.0 to before 14.3.3 Fixed in 14.3.3 Patch available GHSA-gfr2-rv44-r23c
  • markdown-it (npm) Vendor— Affected 15.0.0 to before 15.0.3 Fixed in 15.0.3 Patch available GHSA-gfr2-rv44-r23c

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:markdown-it_project:markdown-it:*:*:*:*:*:*:*:*——Markdown-it Project
  • cpe:2.3:a:markdown-it_project:markdown-it:*:*:*:*:*:*:*:* Versions — — ·Markdown-it Project

Remediation

Upgrade the markdown-it npm package to 14.3.3 for the 14.x branch or to 15.0.3 for the 15.x branch. Red Hat lists Red Hat Build of Podman Desktop, Red Hat Ceph Storage 9, Red Hat Developer Hub 1, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces and Self-service automation portal 2 as affected, with no fix plan available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA markdown-it (markdown-it) Fixed in 14.3.3, 15.0.3
  • Fix · GHSA-gfr2-rv44-r23c markdown-it (npm) Fixed in 14.3.3 Advisory →
  • Fix · GHSA-gfr2-rv44-r23c markdown-it (npm) Fixed in 15.0.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Developer Hub 1AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Self-service automation portal 2AffectedNo fix yet
Not affected: 3 products
  • Red Hat Developer Hub 1
  • Red Hat Hardened Images
  • Red Hat OpenShift Dev Spaces

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-111758
  2. 2026-10-21 Alias added: GHSA-gfr2-rv44-r23c
  3. 2026-10-21 Fix available: npm/[email protected], npm/[email protected] · GHSA-gfr2-rv44-r23c
  4. 2026-10-21 CVSS score added · GHSA-gfr2-rv44-r23c
  5. 2026-10-21 Weakness changed · GHSA-gfr2-rv44-r23c
  6. 2026-10-21 6 new references · GHSA-gfr2-rv44-r23c
  7. 2026-10-21 Affected versions changed · Red Hat
  8. 2026-10-21 CVSS score added · Red Hat
  9. 2026-10-22 Priority changed: MEDIUM → LOW
  10. 2026-10-23 Affected versions changed · Red Hat
  11. 2026-10-27 Affected versions changed · Red Hat
  12. 2026-10-28 CISA SSVC decision points changed
  13. 2026-10-28 Priority changed: LOW → HIGH

References

Other 6

  • TI-2026-36071 linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop CVSS 4.0HIGH 8.7
  • TI-2026-76535 Quadratic time in markdown-it smartquotes causes denial of service CVSS 3.1HIGH 7.5
  • TI-2026-42701 linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text CVSS 3.1HIGH 7.5
  • TI-2025-07289 Markdown-it 14.1.0 - Cross-site scripting (XSS) CVSS 4.0MEDIUM 6.9
  • TI-2026-36244 markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations CVSS 3.1MEDIUM 5.3
  • TI-2022-06047 Uncontrolled Resource Consumption in markdown-it CVSS 3.1MEDIUM 5.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences