CVE-2026-111766— markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
Quick assessment
Affected
markdown-it markdown-it
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
markdown-it 是一个 Markdown 解析器。在版本 14.3.3 和 15.0.3 之前，当启用 选项或 预设，且相关结构出现在段落内部时，攻击者控制的 Markdown 内容若包含重复出现的未终止行内 HTML 注释、处理指令、声明或 CDATA 区段，会被传递到 。其中的 匹配会搜索剩余后缀以寻找对应的结束符；当不存在结束符时，解析过程会推进到下一个起始标签，并对重叠的输入重复执行匹配操作，从而导致二次方（O(n²)）的时间复杂度，引发拒绝服务攻击，表现为事件循环阻塞或浏览器主线程无响应。HTML
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111766
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
Source: CVE Program / CVE List V5
Vulnerability Description
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| markdown-it | markdown-it | >= 15.0.0, < 15.0.3 | - |
|
II. Public POCs for CVE-2026-111766
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111766
请登录查看更多情报信息。
Other References for CVE-2026-111766 (5)
-
https://github.com/markdown-it/markdown-it/releases/tag/14.3.3 x_refsource_MISC
-
https://github.com/markdown-it/markdown-it/releases/tag/15.0.3 x_refsource_MISC
IV. Related Vulnerabilities
Same product: markdown-it
Same vendor: markdown-it
-
CVE-2026-111759
markdown-it: Quadratic complexity in smartquotes with unmatc -
CVE-2026-48801
linkify-it: Quadratic algorithmic complexity in LinkifyIt#ma -
CVE-2026-59887
linkify-it: Quadratic-complexity DoS via the `mailto:` valid -
CVE-2026-48988
markdown-it: Quadratic complexity DoS in smartquotes rule vi -
CVE-2025-7969
Markdown-it 14.1.0 - Cross-site scripting (XSS)
Same weakness: CWE-400
-
CVE-2026-112400
Pillow: GIF seek keeps rejected size after DecompressionBomb -
CVE-2026-112782
Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Deni -
CVE-2026-111759
markdown-it: Quadratic complexity in smartquotes with unmatc -
CVE-2026-111066
AIOHTTP: File descriptor exhaustion in multipart requests -
CVE-2026-12343
IBM MQ Denial of Service
V. Comments for CVE-2026-111766
No comments yet