ROOT-APP-NPM-AIKIDO-2026-549894 AIKIDO-2026-549894 in markdown-it - Patched by Root

Root has patched AIKIDO-2026-549894 in the markdown-it package for Root:npm. Multiple fixed versions available...

markdown-it Heap Buffer Overflow DoS

The vulnerability of the charCodeAt and slice functions in the markdown-it library is related to its inefficient algorithmic complexity. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

Linux Distros Unpatched Vulnerability : CVE-2026-111766

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph,...

CVE-2026-111758

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is On² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...

CVE-2026-111758

A flaw was found in markdown-it. A remote attacker can cause a Denial of Service DoS by providing specially crafted Markdown input that contains an unclosed link reference definition spanning multiple lines. Processing this input triggers excessive CPU consumption due to inefficient string...

markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

Summary A link reference definition whose label or title is never closed is On² in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copyin...

GHSA-GFR2-RV44-R23C markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

Summary A link reference definition whose label or title is never closed is On² in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copyin...

npm: markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

npm: markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options regression since 14.0 vulnerability discovered by ? in WordPress npm markdown-it versions = 14.1.0, 14.3.3...

CVE-2026-111758 markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is On² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...

CVE-2026-111758 markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is On² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...

EUVD-2026-105358

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is On² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...

CVE-2026-111758

The markdown-it Markdown parser is vulnerable to an algorithmic-complexity denial of service (CWE-407) due to quadratic-time rendering of multi-line link reference definitions. In versions 14.1.0 to before 14.3.3 and 15.0.0 to before 15.0.3 , providing a definition where the label or title is nev...

GHSA-VFGH-JCMW-G37Q markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

Summary With html: true, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments , ?, , and . When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again...

markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

Summary With html: true, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments , ?, , and . When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again...

EUVD-2026-104595

markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled...

npm: markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

npm: markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled vulnerability discovered by ? in WordPress npm markdown-it versions 14.3.3...

markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes

Impact When typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause...

EUVD-2026-104538

markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes...

npm: markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes

npm: markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes vulnerability discovered by ? in WordPress npm markdown-it versions 14.3.2...

Linux Distros Unpatched Vulnerability : CVE-2026-111759

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time ...