Denial of Service Vulnerability in Microlight JavaScript Library

CVE-2025-45526

What is CVE-2025-45526?

The Microlight JavaScript library, utilized for syntax highlighting, has a vulnerability that allows an attacker to cause a denial of service. This occurs due to the library's failure to restrict the size of textual content processed in HTML elements with the microlight class. If an attacker tricks a user into visiting a malicious site with an excessively large content string (e.g., 100 million characters), the library's reset function will consume excessive CPU and memory resources, resulting in browser crashes or unresponsiveness. It is crucial for developers to address this vulnerability to prevent potential exploitation.

References