Vulnerability Description
markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22
- https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43d
- https://github.com/markdown-it/markdown-it/releases/tag/14.3.3
- https://github.com/markdown-it/markdown-it/releases/tag/15.0.3
- https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r2
- https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r2
FAQ
What is CVE-2026-111758?
CVE-2026-111758 is a vulnerability with a CVSS score of 7.5 (HIGH). markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Co...
How severe is CVE-2026-111758?
CVE-2026-111758 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-111758?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.