{"id":"ghsa-ghsa-vfgh-jcmw-g37q","seq":2390,"kind":"advisory","title":"markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled","url":"https://github.com/advisories/GHSA-vfgh-jcmw-g37q","permalink":"https://vulnpulse.app/items/ghsa-ghsa-vfgh-jcmw-g37q","summary":"影響: npm:markdown-it < 14.3.3 → 14.3.3, npm:markdown-it >= 15.0.0, < 15.0.3 → 15.0.3\nSummary With html: true, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments ( , ?>, >, and ]]>. When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again. Repeating this across the paragraph produces quadratic total work. For these inputs, the problem is repeated scanning across separate matches. The payload must reach inline parsing. Prefixing it wit…","severity":"low","techs":["nodejs"],"cves":["CVE-2026-111766"],"tags":["GHSA-vfgh-jcmw-g37q","markdown-it","markdown-it"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T20:08:19.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}