Denial of Service in Markdown Parser Affecting markdown-it
CVE-2026-111766
3.7LOW
What is CVE-2026-111766?
The markdown-it Markdown parser features a potential denial of service vulnerability that arises when the html option or commonmark preset is enabled. Attackers can exploit this by providing specially crafted Markdown input, which contains repeated unterminated inline HTML comments and other constructs. This manipulation causes the parser to enter an inefficient state during processing, resulting in significant performance degradation, event-loop blocking, or rendering a browser unresponsive. The issue has been resolved in versions 14.3.3 and 15.0.3, ensuring that users avoid this parsing issue.
Affected Version(s)
markdown-it >= 15.0.0, < 15.0.3 < 15.0.0, 15.0.3
markdown-it < 14.3.3 < 14.3.3