CVE-2026-111758

A flaw was found in markdown-it. A remote attacker can cause a Denial of Service DoS by providing specially crafted Markdown input that contains an unclosed link reference definition spanning multiple lines. Processing this input triggers excessive CPU consumption due to inefficient string...

npm: markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

npm: markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options regression since 14.0 vulnerability discovered by ? in WordPress npm markdown-it versions = 14.1.0, 14.3.3...

markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

Summary A link reference definition whose label or title is never closed is On² in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copyin...

CVE-2026-111758 markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is On² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...

CVE-2026-111758 markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is On² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...

CVE-2026-111758

The markdown-it Markdown parser is vulnerable to an algorithmic-complexity denial of service (CWE-407) due to quadratic-time rendering of multi-line link reference definitions. In versions 14.1.0 to before 14.3.3 and 15.0.0 to before 15.0.3 , providing a definition where the label or title is nev...

CVE-2026-111758 markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is On² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...

EUVD-2026-105358

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is On² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...

PT-2026-118647

Name of the Vulnerable Software and Affected Versions markdown-it versions 14.1.0 through 14.3.2 markdown-it versions 15.0.0 through 15.0.2 Description An algorithmic-complexity denial of service exists when processing a link reference definition with a label or title that is never closed. Using...

md4c buffer overflow vulnerability (CNVD-2018-15761)

md4c is a C-based Markdown a markup language parser . A buffer overflow vulnerability exists in the 'mdislinkreferencedefinitionhelper' function in version 0.2.5 of md4c, which stems from the program failing to properly handle loop termination. An attacker could use this vulnerability to cause a...

PT-2018-10654

Name of the Vulnerable Software and Affected Versions md4c version 0.2.5 Description The issue arises from a heap-based buffer over-read in the md is link reference definition helper function within md4c. This occurs due to md is link label mishandling loop termination, leading to improper handli...