{"id":"CVE-2026-111766","title":"markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled","summary":"markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML com…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssSource":"cna","cwe":["CWE-400","CWE-407","CWE-1333"],"vendor":"markdown-it","product":"markdown-it","affected":["markdown-it >= 15.0.0, < 15.0.3","markdown-it < 14.3.3"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-26T17:29:30.362422Z"},"published":"2026-10-19","updated":"2026-10-26","sourceUpdated":"2026-10-26T17:37:11.818Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111766","references":[{"url":"https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q","label":"https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q"},{"url":"https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","label":"https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79"},{"url":"https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","label":"https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503"},{"url":"https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","label":"https://github.com/markdown-it/markdown-it/releases/tag/14.3.3"},{"url":"https://github.com/markdown-it/markdown-it/releases/tag/15.0.3","label":"https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111766"},{"url":"https://github.com/advisories/GHSA-vfgh-jcmw-g37q"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111766.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-111766"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555815"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111766"}],"tags":["cve.org","ghsa","npm","csaf","vex","red-hat"],"epss":0.00428,"epssPercentile":0.36848,"aliases":["GHSA-vfgh-jcmw-g37q"],"ecosystem":"npm","patched":["markdown-it 14.3.3","markdown-it 15.0.3"],"ingestedAt":"2026-10-19T20:41:18.453Z","slug":"CVE-2026-111766","body":"## Overview\n\nmarkdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.\n\n## Affected\n\n- `markdown-it >= 15.0.0, < 15.0.3`\n- `markdown-it < 14.3.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-111766)\n\nAffected packages:\n\n- `markdown-it < 14.3.3`\n- `markdown-it >= 15.0.0, < 15.0.3`\n\nPatched in:\n\n- `markdown-it 14.3.3`\n- `markdown-it 15.0.3`\n\nSource: https://github.com/advisories/GHSA-vfgh-jcmw-g37q\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Build of Podman Desktop, Red Hat Ceph Storage 9, Red Hat Developer Hub, Red Hat Hardened Images, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces, … · no fix planned: Red Hat Build of Podman Desktop, Red Hat Ceph Storage 9, Red Hat Developer Hub, Red Hat OpenShift AI (RHOAI), … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111766.json)","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}