CVE-2026-86434: commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
league/commonmarkto a version that resolves this vulnerability.Fixed in 2.9.0 - Compensating control
If you cannot upgrade immediately, prevent unauthenticated access to any Markdown rendering path that registers HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension to reduce exposure to slug-collision DoS.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using league/commonmark versions 2.0.0 through 2.8.3 are affected when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. The vulnerable code path is not described as reachable without one of these extensions.
What does an attacker need to exploit it?
An unauthenticated attacker needs to be able to supply Markdown that the application processes. They can use many headings that resolve to the same base slug, such as empty ATX headings, identical heading text, or punctuation-only headings.
How can we determine whether our application is at risk?
Check the installed league/commonmark version and whether any of the three affected extensions are registered. Applications that process untrusted Markdown containing large numbers of colliding headings can experience excessive CPU consumption.
What should be done if the affected configuration is in use?
Update to a version containing the fix; the issue is stated as patched in 2.9.0. Until updating, limit or avoid processing untrusted Markdown that can contain many headings with the same normalized slug.