{"id":"ghsa-ghsa-gfr2-rv44-r23c","seq":2389,"kind":"advisory","title":"markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)","url":"https://github.com/advisories/GHSA-gfr2-rv44-r23c","permalink":"https://vulnpulse.app/items/ghsa-ghsa-gfr2-rv44-r23c","summary":"影響: npm:markdown-it >= 14.1.0, < 14.3.3 → 14.3.3, npm:markdown-it >= 15.0.0, < 15.0.3 → 15.0.3\nSummary A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. It is a regression introduced by PR #1004 in 14.0.0: 13.0.2 processed a 313 KB input in 125 ms, while every…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-111758"],"tags":["GHSA-gfr2-rv44-r23c","markdown-it","markdown-it"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T20:28:44.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}