Improper handling of highly compressed data in HedgeDoc - CVE-2026-58486

Vulnerability details

The vulnerability allows a remote user to cause a persistent denial of service by exhausting CPU resources and blocking the Node.js event loop.

The vulnerability exists due to uncontrolled YAML alias expansion in HedgeDoc's note frontmatter processing when handling requests to the publish or editor view. A remote user can create a note containing a compact YAML alias bomb and request its publish view, or its editor view when the payload is under the opengraph key, to trigger excessive processing and make the instance unavailable.

The malicious note remains stored in the database and can trigger the denial of service again after process restarts.

Affected software

How to mitigate CVE-2026-58486

External References

• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-qj78-mjch-wwrv
• https://github.com/hedgedoc/hedgedoc/commit/c489497e451887bfe400434c5a010940051e9890

Related Security Bulletins

• Multiple vulnerabilities in HedgeDoc