Inefficient Algorithmic Complexity in markdown-it - CVE-2026-111758
Published: November 9, 2026
Vulnerability identifier: #VU162981
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-111758
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause denial of service on servers that render user-supplied Markdown with markdown-it.
The vulnerability exists due to repeated copying of accumulated text in markdown-it's link reference parser when processing multiline definitions with unclosed labels or titles under default options. An unauthenticated remote attacker can submit approximately 800 KB of crafted Markdown to block the Node.js event loop for about 74 seconds.
Affected software
markdown-it
Fedora
markdownlint-cli2
Fedora
markdownlint-cli2
How to mitigate CVE-2026-111758
Install security update from vendor's website.
markdown-it - addressed in versions 14.3.3, 15.0.3
markdownlint-cli2 - addressed in versions 0.24.0-1.fc43, 0.24.0-1.fc44, 0.24.0-1.fc45
markdownlint-cli2 - addressed in versions 0.24.0-1.fc43, 0.24.0-1.fc44, 0.24.0-1.fc45