Inefficient Algorithmic Complexity in markdown-it - CVE-2026-111766
Published: November 9, 2026
Vulnerability identifier: #VU162980
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-111766
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause denial of service in applications rendering attacker-controlled Markdown.
The vulnerability exists due to quadratic rescanning in markdown-it's inline HTML parser when repeated unterminated HTML constructs occur inside a paragraph with html: true, including the commonmark preset. An unauthenticated remote attacker can submit a few hundred kilobytes of crafted Markdown to block the Node.js event loop for seconds, delaying other requests.
Affected software
markdown-it
Fedora
markdownlint-cli2
Fedora
markdownlint-cli2
How to mitigate CVE-2026-111766
Install security update from vendor's website.
markdown-it - addressed in versions 14.3.3, 15.0.3
markdownlint-cli2 - addressed in versions 0.24.0-1.fc43, 0.24.0-1.fc44, 0.24.0-1.fc45
markdownlint-cli2 - addressed in versions 0.24.0-1.fc43, 0.24.0-1.fc44, 0.24.0-1.fc45