CVE-2026-111766 markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
Attackers can cause denial of service via quadratic-time processing in markdown-it when HTML parsing is enabled, blocking the event loop or browser thread.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-111766?
CVE-2026-111766 is a low-severity denial of service vulnerability in markdown-it, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.
Which versions are affected by CVE-2026-111766?
4 open source packages ship an affected version, including markdown-it.
| Package | Affected | Fixed in |
|---|---|---|
markdown-it npm | All versions | 14.3.3 |
markdown-it npm | All versions | 14.3.3 |
markdown-it npm | From 15.0.0 | 15.0.3 |
markdown-it npm | From 15.0.0 | 15.0.3 |
How do I fix CVE-2026-111766?
Upgrade markdown-it to a fixed version for your release line: 14.3.3 or 15.0.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-111766 being exploited?
There is no known exploitation of CVE-2026-111766 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1793097495, CLSA-2026-1793097603, CLSA-2026-1793099982, CLSA-2026-1793100014, CLSA-2026-1793125795, DEBIAN-CVE-2026-111766 and 3 more.