CVE-2026-111758: markdown-it Quadratic-Time Rendering Vulnerability
Summary
CVE-2026-111758: A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with default options. Affects markdown-it across 2 version ranges.
>= 14.1.0, < 14.3.3
>= 15.0.0, < 15.0.3
Fixed in 14.3.3 or 15.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
markdown-it is a popular Markdown parser for JavaScript, widely used for converting Markdown text into HTML. It is known for its extensibility and performance. However, a recent vulnerability has been identified that affects its rendering efficiency, particularly when handling multi-line link reference definitions.
Vulnerability Detail
The vulnerability arises from a regression introduced in version 14.0.0 of markdown-it, where a link reference definition with an unclosed label or title can lead to quadratic-time rendering. This means that processing such a definition can take significantly longer than expected, potentially blocking the Node.js event loop for extended periods. The issue is rooted in how continuation lines are handled, causing excessive string copying in memory. As a result, a server using markdown-it to render user-generated Markdown can experience denial of service (DoS) attacks, where large inputs can severely degrade performance.
How To Fix
Latest published version: 15.0.3 as of 22 Oct 2026
npm install markdown-it@15.0.3The newest release already contains this fix.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 14.1.0, < 14.3.314.3.3npm install markdown-it@14.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the reference parsing feature by using the following code snippet:
md.disable('reference');
This will prevent the quadratic-time rendering issue from occurring, but may limit some Markdown functionality.
Conclusion
The markdown-it package has a significant vulnerability that can lead to performance issues when rendering certain Markdown inputs. It is crucial for users to update to the patched versions to mitigate the risk of denial of service attacks. Additionally, using Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for markdown-it →
FAQ
CVE-2026-111758 is a vulnerability in the markdown-it package that causes quadratic-time rendering for certain multi-line link reference definitions, leading to potential denial of service.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The vulnerability can lead to significant performance degradation, blocking the Node.js event loop for long periods, which can affect the responsiveness of applications that render user Markdown.
Versions 14.1.0 to 15.0.2 are affected by this vulnerability. It is recommended to update to 14.3.3 or 15.0.3 or later.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for markdown-it.
