CVE-2026-111766 in markdown-it
Summary
by MITRE • 10/19/2026
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified within the markdown-it library constitutes a significant availability risk stemming from inefficient regular expression handling during Markdown parsing operations. Specifically, this flaw affects versions prior to 14.3.3 and 15.0.3 when the html option is enabled or when using the commonmark preset configuration. The core technical issue resides in the src/rules_inline/html_inline.ts module, which processes inline HTML elements embedded within paragraph structures. Under normal circumstances, this parser attempts to match valid HTML tags against a predefined regular expression pattern known as HTML_TAG_RE. However, the implementation fails to account for input strings that contain repeated sequences of unterminated inline HTML comments, processing instructions, declarations, or CDATA sections. When such malformed input is provided by an attacker, the parsing logic encounters a scenario where no terminating character sequence exists within the remaining suffix of the string.
In response to this missing terminator, the parser does not immediately fail or halt but instead employs a backtracking mechanism that advances to the next potential opener and repeats the matching process over overlapping segments of the input data. This behavior results in quadratic time complexity relative to the length of the malicious payload. As the size of the attacker-controlled Markdown increases, the computational effort required by the regular expression engine grows exponentially rather than linearly. This algorithmic inefficiency leads directly to severe performance degradation, manifesting as a denial of service condition. In server-side environments utilizing Node.js, this excessive processing time blocks the event loop, preventing the application from handling other concurrent requests and effectively freezing the service. Similarly, in client-side applications where markdown-it is used for rendering user-generated content within web browsers, the synchronous nature of such heavy computation can cause the main thread to become unresponsive, leading to a frozen browser interface that requires manual intervention by the end-user to recover.
From a classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, specifically highlighting how improper input validation leads to excessive resource usage. Furthermore, it maps to MITRE ATT&CK technique T1496, known as Resource Hijacking, where an adversary leverages computational resources to disrupt service availability without necessarily compromising data confidentiality or integrity. It is important to note that the vulnerability is context-specific and does not impact HTML blocks processed in block-level contexts nor configurations where HTML rendering is explicitly disabled by default settings. The attack vector requires the attacker to supply crafted Markdown input directly to a parser instance configured with permissive HTML handling options, making it primarily relevant for applications that parse untrusted user content while allowing inline HTML tags.
To mitigate this risk, organizations utilizing markdown-it must upgrade immediately to version 14.3.3 or later, which includes patches addressing the regular expression backtracking issue and optimizing the parsing logic to prevent quadratic complexity attacks. For environments where immediate patching is not feasible due to dependency constraints, alternative mitigation strategies include implementing strict input sanitization layers before passing content to the parser, thereby stripping out potentially malicious HTML constructs such as unterminated comments or CDATA sections. Additionally, configuring the parser with stricter presets that disable inline HTML processing can reduce the attack surface significantly if full HTML support is not strictly required by the application logic. Monitoring for unusually long parsing durations and implementing timeouts on markdown rendering processes can also serve as a defensive measure to limit the impact of such denial-of-service attempts in production environments.