CVE-2026-111766
Awaiting Analysis Awaiting Analysis - Queue

ReDoS in markdown-it via Malformed HTML Comments

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-21
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111766
EUVD
EUVD-2026-104595

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
markdown-it markdown-it >= 15.0.0, < 15.0.3
markdown-it markdown-it < 14.3.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111766 is a denial of service vulnerability in the markdown-it library's inline HTML parsing. When the html option or commonmark preset is enabled, attacker-controlled Markdown with repeated unterminated HTML constructs like comments or CDATA sections causes quadratic processing time. This leads to excessive CPU usage and event-loop blocking, making applications unresponsive.

Detection Guidance

To detect this vulnerability, monitor for unusually high CPU usage or unresponsive behavior when processing Markdown with HTML enabled. Check if your markdown-it version is below 14.3.3 or between 15.0.0 and 15.0.2. Use commands like 'npm list markdown-it' to verify installed versions.

Impact Analysis

An attacker can exploit this by sending a few hundred kilobytes of crafted input, causing the Node.js event loop to block for seconds or tens of seconds. This delays other requests and may make the application unresponsive. The default HTML-disabled configuration is not affected.

Compliance Impact

This vulnerability primarily impacts system availability by causing denial of service through excessive CPU usage. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged unavailability could indirectly impact compliance by disrupting access to personal or health data processing systems.

Mitigation Strategies

Immediately upgrade markdown-it to version 14.3.3 or 15.0.3 or later. If upgrading is not possible, disable HTML parsing by setting the 'html' option to false in your configuration. Additionally, implement input size limits to prevent large crafted payloads from being processed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111766. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart