Markdown Parser Vulnerability in markdown-it by Markdown It
CVE-2026-111758
What is CVE-2026-111758?
The markdown-it Markdown parser experiences a potential Denial of Service vulnerability when processing certain link reference definitions. Specifically, from versions 14.1.0 to prior to 14.3.3 and from 15.0.0 to prior to 15.0.3, the parser exhibits an O(n²) behavior under specific conditions. This occurs due to the lazy loading of continuation lines in the reference definitions, resulting in inefficient memory usage and processing delays. This issue is not dependent on specific options and can be triggered by standard usage of the parser. Users are strongly encouraged to upgrade to versions 14.3.3 or 15.0.3, where the issue has been addressed.
Affected Version(s)
markdown-it >= 14.1.0, < 14.3.3 < 14.1.0, 14.3.3
markdown-it >= 15.0.0, < 15.0.3 < 15.0.0, 15.0.3