markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
影響: npm:markdown-it < 14.3.3 → 14.3.3, npm:markdown-it >= 15.0.0, < 15.0.3 → 15.0.3
With html: true, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments ( , ?>, >, and ]]>. When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again. Repeating this across the paragraph produces quadratic total work. For these inputs, the problem is repeated scanning across separate matches. The payload must reach inline parsing. Prefixing it wit…
| CVE | CVE-2026-111766 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 22. 오전 01:17 |
| 데이터 | Markdown JSON |
2026. 10. 21. 오전 05:08, GitHub Advisory Database에서 "markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "낮음"(low)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-111766.