CVE-2026-111758

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400",
        "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111758.json"
}

References

Affected packages

Git / github.com/markdown-it/markdown-it

Affected ranges

Type

GIT

Repo

https://github.com/markdown-it/markdown-it

Events

Introduced

0fe7ccb4b7f30236fb05f623be6924961d296d3d

Fixed

d372f0d8a68bef0b0acaa68868ce8ae8ba85b384

Introduced

157b33bc13649aebecf9ab9b3b8c85ae645abb5a

Fixed

a8c00d474ec9b304fad9b71c16d6fa8b4909279e

Fixed

48fbc465812c440020c663f040ab22deaf8f1eca

Fixed

d99f48839d37af6fd8a2617516c43dab90755503

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "14.1.0"
                },
                {
                    "fixed": "14.3.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "15.0.0"
                },
                {
                    "fixed": "15.0.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "48fbc465812c440020c663f040ab22deaf8f1eca"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "d99f48839d37af6fd8a2617516c43dab90755503"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "14.3.3",
            "range": [
                {
                    "fixed": "d372f0d8a68bef0b0acaa68868ce8ae8ba85b384"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "15.0.3",
            "range": [
                {
                    "fixed": "a8c00d474ec9b304fad9b71c16d6fa8b4909279e"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

14.*

14.1.0

14.1.1

14.2.0

14.3.0

14.3.1

14.3.2

15.*

15.0.0

15.0.1

15.0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111758.json"