CVE-2026-111758

Awaiting Analysis Awaiting Analysis - Queue

markdown-it Link Reference Definition O(n²) Complexity Issue

Publication date: 2026-10-20

Last updated on: 2026-10-28

Assigner: GitHub, Inc.

Description

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-111758

Affected Vendors & Products

Vendor	Product	Version / Range
markdown-it	markdown-it	>= 14.1.0, < 14.3.3
markdown-it	markdown-it	>= 15.0.0, < 15.0.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a performance issue in the markdown-it Markdown parser. When a link reference definition has an unclosed label or title, the parser processes it inefficiently, causing O(n²) time complexity. This happens because continuation lines are handled in a way that forces V8 to flatten and copy accumulated string data repeatedly before determining the definition is invalid.

Detection Guidance

This vulnerability affects markdown-it versions 14.1.0 to before 14.3.3 and 15.0.0 to before 15.0.3. To detect it, check the installed version of markdown-it in your project using commands like 'npm list markdown-it' or 'yarn list markdown-it'. If the version falls within the vulnerable range, the system is affected.

Impact Analysis

This vulnerability can cause high CPU usage and slow performance when processing large Markdown files with malformed link references. It may lead to denial-of-service conditions if exploited to consume excessive system resources during parsing.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a performance issue (O(n²) complexity) rather than a data security or privacy breach. It may indirectly impact compliance if system performance degradation leads to operational issues affecting regulated environments.

Mitigation Strategies

Upgrade markdown-it to version 14.3.3 or later, or 15.0.3 or later, depending on which major version you are using. For npm projects, run 'npm update markdown-it' or specify the patched version in package.json. For yarn, use 'yarn upgrade markdown-it'.

Hi! I’m here to help you understand CVE-2026-111758. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...