CVE-2026-111766: markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rulesinline/htmlinline.ts. Its HTMLTAGRE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
markdown-itto a version that resolves this vulnerability.Fixed in 14.3.3 - Upgrade
Upgrade
markdown-itto a version that resolves this vulnerability.Fixed in 15.0.3
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Deployments using markdown-it before 14.3.3 or 15.0.3 are exposed only when the html option or the commonmark preset is enabled and attacker-controlled Markdown can be parsed inside a paragraph. The default configuration with HTML disabled is not affected by these payloads, and HTML blocks are not affected.
What input is required to trigger the issue?
An attacker needs to supply Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections within a paragraph. Missing terminators cause repeated searches across overlapping remaining input, resulting in quadratic processing.
What is the practical impact of successful exploitation?
Processing the crafted Markdown can consume enough time to block the event loop or make a browser main thread unresponsive. The provided severity vector indicates availability impact only, with no confidentiality or integrity impact.
What should be done if an immediate upgrade is not possible?
Disable the html option and avoid the commonmark preset where feasible, since the default HTML-disabled configuration is not affected. Also prevent untrusted Markdown from containing the affected unterminated inline HTML constructs in paragraphs.