markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

影響: npm:markdown-it < 14.3.3 → 14.3.3, npm:markdown-it >= 15.0.0, < 15.0.3 → 15.0.3

With html: true, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments ( , ?>, >, and ]]>. When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again. Repeating this across the paragraph produces quadratic total work. For these inputs, the problem is repeated scanning across separate matches. The payload must reach inline parsing. Prefixing it wit…

在 GitHub Advisory Database 阅读

2026/10/21 05:08，GitHub Advisory Database 发布了“markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled”（类型：漏洞公告）。严重程度为“低危”（low）。相关技术：JavaScript / Node.js。CVE：CVE-2026-111766。