CVE-2026-111758

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is On² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...

markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

Summary A link reference definition whose label or title is never closed is On² in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copyin...

GHSA-GFR2-RV44-R23C markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

Summary A link reference definition whose label or title is never closed is On² in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copyin...

CVE-2026-111758

The markdown-it Markdown parser is vulnerable to an algorithmic-complexity denial of service (CWE-407) due to quadratic-time rendering of multi-line link reference definitions. In versions 14.1.0 to before 14.3.3 and 15.0.0 to before 15.0.3 , providing a definition where the label or title is nev...

CVE-2026-111758 markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is On² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...