markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled (CVE-2026-111766)

markdown-it with the option html: true enabled suffers from a quadratic-time denial of service vulnerability in inline HTML parsing. The parser attempts to match repeated unterminated HTML constructs (comments, processing instructions, declarations, CDATA) inside paragraphs. When terminators are missing, the parser repeatedly scans overlapping input suffixes, causing quadratic complexity. This leads to significant blocking of the Node.js event loop with attacker-controlled input of a few hundred kilobytes. The issue affects markdown-it versions <14.3.3 and >=15.0.0 <15.0.3. The default configuration disables HTML parsing, but the commonmark preset enables it. The vulnerability was confirmed on [email protected] with Node.js 20 and 24.16.0. A patch is available to avoid repeated failed searches by caching failed attempts across all four affected HTML constructs.

This vulnerability causes availability degradation by blocking the Node.js event loop for seconds to tens of seconds when parsing crafted Markdown input with html: true enabled. It affects applications that render attacker-controlled Markdown with this setting, including those using the commonmark preset. The impact is limited to denial of service (no confidentiality or integrity impact). The CVSS score is 3.7 (low) due to network attack vector, high attack complexity, no privileges required, no user interaction, and only availability impact.

A patch is available for markdown-it that addresses this quadratic-time denial of service issue. Users should upgrade to a fixed version (>=14.3.3 or >=15.0.3). If upgrading is not immediately possible, disabling HTML parsing (html: false) prevents this issue, as the default configuration does. Applications using the commonmark preset should be especially cautious and consider disabling HTML or applying the patch. No other mitigations are specifically recommended.