## markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

- 種別: advisory
- 重大度: high
- 関連技術: nodejs
- CVE: CVE-2026-111758
- 公開日時: 2026-10-20T20:28:44.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-gfr2-rv44-r23c)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-gfr2-rv44-r23c

影響: npm:markdown-it >= 14.1.0, < 14.3.3 → 14.3.3, npm:markdown-it >= 15.0.0, < 15.0.3 → 15.0.3
Summary A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. It is a regression introduced by PR #1004 in 14.0.0: 13.0.2 processed a 313 KB input in 125 ms, while every…