markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) (CVE-2026-111758)

A regression introduced in markdown-it 14.0.0 causes quadratic-time complexity (O(n²)) when processing a link reference definition whose label or title is never closed. The root cause is the use of string concatenation (str += lineContent) combined with subsequent charCodeAt and slice calls that flatten V8 cons-strings, copying the entire accumulated string repeatedly. This inefficiency leads to exponential increases in processing time as input size grows, with benchmarks showing a 313 KB input taking 11 seconds versus 125 ms in version 13.0.2. The vulnerability affects default options and does not require any opt-in. The issue is confirmed by tests disabling the reference rule or inline parsing, which revert performance to linear. The fix involves tracking positions in the source string rather than concatenating or limiting the scanned label length. Versions affected are >=14.1.0 <14.3.3 and >=15.0.0 <15.0.3.

This vulnerability enables an attacker to cause a denial of service by submitting specially crafted Markdown input that triggers quadratic-time parsing in markdown-it. The Node.js event loop is blocked for extended periods (e.g., ~18 seconds for 400 KB input, ~74 seconds for 800 KB input), severely degrading service availability. This affects any server rendering user Markdown with markdown-it default options, including comments, issues, chat, wikis, documentation previews, and LLM chat UIs. There is no confidentiality or integrity impact, but availability is significantly affected.

A patch is available for this vulnerability. Users should upgrade markdown-it to versions 14.3.3 or later, or 15.0.3 or later, where the issue is fixed. The fix involves changing the parsing logic to avoid inefficient string concatenation and bounding the scanned label length. Until patched, disabling the reference parsing rule or inline parsing can mitigate the issue but may reduce Markdown functionality. No additional generic mitigations are required as the vulnerability is specific to the parsing of unclosed multi-line link reference definitions.