CVE-2026-111766: markdown-it Parser DOS Vulnerability

CVE-2026-111766 Overview

CVE-2026-111766 is a denial-of-service vulnerability in markdown-it, a widely used JavaScript Markdown parser. The flaw affects versions prior to 14.3.3 and 15.0.3 when the html option or commonmark preset is enabled. Attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections triggers quadratic parsing in src/rules_inline/html_inline.ts. The result is event-loop blocking in server contexts or an unresponsive browser main thread. The weakness is tracked as CWE-400 (Uncontrolled Resource Consumption).

Critical Impact
Attackers can submit crafted Markdown to applications that render user content with HTML parsing enabled, causing CPU exhaustion and unresponsive services.

Affected Products

markdown-it versions prior to 14.3.3
markdown-it versions prior to 15.0.3 (15.x branch)
Applications using markdown-it with the html option or commonmark preset enabled

Discovery Timeline

2026-10-19 - CVE-2026-111766 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-111766

Vulnerability Analysis

The vulnerability lives in the inline HTML parsing path. When markdown-it encounters an inline HTML construct inside a paragraph, it invokes HTML_TAG_RE from src/common/html_re.ts to match tags, comments, processing instructions, declarations, or CDATA sections. The regex searches the entire remaining suffix for a terminator such as --> or ]]>. When no terminator exists, the parser advances to the next opener and re-scans overlapping input. Repeated unterminated openers cause the scan cost to grow quadratically with input length, producing CPU exhaustion.

HTML blocks are not affected. The default configuration, which disables HTML, is also safe. Only paragraph-level inline parsing with HTML enabled triggers the pathological path.

Root Cause

The root cause is unbounded re-scanning in HTML_TAG_RE. The regular expression used lazy matching across the suffix without a mechanism to cache or skip ranges previously determined to lack a terminator. The fix introduces a skipHtmlSpecial flag on the inline state so that subsequent scans for comment, processing instruction, declaration, or CDATA constructs are suppressed once a prior scan has already proven no terminator exists.

Attack Vector

Exploitation requires only the ability to submit Markdown to an application that renders it with HTML parsing enabled. No authentication or user interaction is required beyond content submission. Typical targets include comment systems, wikis, chat platforms, note-taking apps, and static-site generators that process user-supplied Markdown.

typescript

// Patch excerpt — src/common/html_re.ts
 const declaration = '<![A-Za-z][^>]*>'
 const cdata = '<!\\[CDATA\\[[\\s\\S]*?\\]\\]>'
 
+/** @deprecated Will be removed in future versions. */
 const HTML_TAG_RE = new RegExp(
   `^(?:${open_tag}|${close_tag}|${comment}|${processing}|${declaration}|${cdata})`
 )

// Patch excerpt — src/rules_inline/html_inline.ts
-import { HTML_TAG_RE } from '../common/html_re.ts'
+import { HTML_OPEN_CLOSE_TAG_RE } from '../common/html_re.ts'

// Patch excerpt — lib/rules_inline/state_inline.mjs
+  // Set when html comment / PI / declaration / CDATA has no terminator,
+  // to skip further scans of these constructs
+  this.skipHtmlSpecial = false

Source: GitHub commit 928bc8c and GitHub commit d99f488.

Detection Methods for CVE-2026-111766

Indicators of Compromise

Sustained single-threaded CPU saturation in Node.js processes or browser tabs that render Markdown
HTTP request handlers blocked on Markdown rendering, producing elevated response latency or timeouts
Request payloads containing long sequences of <!--, <?, <![, or <!CDATA[ tokens without matching terminators

Detection Strategies

Inventory applications depending on markdown-it and check installed versions against 14.3.3 and 15.0.3 using npm ls markdown-it or Software Bill of Materials (SBOM) tooling
Deploy Web Application Firewall (WAF) rules that flag request bodies containing high-frequency unterminated HTML comment or CDATA openers
Correlate application performance monitoring (APM) spikes in Markdown-rendering code paths with inbound request payload patterns

Monitoring Recommendations

Monitor Node.js event-loop lag and set alerts when latency exceeds normal baselines
Log and sample Markdown input sizes and processing durations to detect anomalous rendering times
Track dependency drift through continuous Software Composition Analysis (SCA) scans in CI/CD pipelines

How to Mitigate CVE-2026-111766

Immediate Actions Required

Upgrade markdown-it to 14.3.3 (14.x branch) or 15.0.3 (15.x branch) as the primary remediation
Audit application configuration and disable the html option unless strictly required
Avoid the commonmark preset for untrusted input until the dependency is patched

Patch Information

The maintainers released fixed versions 14.3.3 and 15.0.3. See the GitHub Security Advisory GHSA-vfgh-jcmw-g37q, release 14.3.3, and release 15.0.3. The fix replaces the broad HTML_TAG_RE usage in inline parsing with HTML_OPEN_CLOSE_TAG_RE and introduces a skipHtmlSpecial state flag to prevent redundant suffix scans.

Workarounds

Keep the default HTML-disabled configuration if your application does not need inline HTML support
Enforce a maximum size limit on user-submitted Markdown payloads at the application or reverse-proxy layer
Render Markdown in a sandboxed worker thread with a hard execution timeout to contain quadratic parsing

bash

# Upgrade using npm
npm install markdown-it@^15.0.3
# or for 14.x consumers
npm install markdown-it@^14.3.3

# Verify installed version
npm ls markdown-it