markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

影響: npm:markdown-it < 14.3.3 → 14.3.3, npm:markdown-it >= 15.0.0, < 15.0.3 → 15.0.3

With html: true, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments ( , ?>, >, and ]]>. When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again. Repeating this across the paragraph produces quadratic total work. For these inputs, the problem is repeated scanning across separate matches. The payload must reach inline parsing. Prefixing it wit…

Read on GitHub Advisory Database

On 10/21/2026, 05:08 AM, GitHub Advisory Database published "markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled" (type: Advisory). Severity is "Low" (low). Related technologies: JavaScript / Node.js. CVE: CVE-2026-111766.