CVE-2026-86430: Thephpleague Commonmark DOS Vulnerability

CVE-2026-86430 Overview

CVE-2026-86430 affects league/commonmark versions before 2.9.1, a widely used PHP Markdown parser. The library contains multiple denial of service weaknesses in fenced code block detection, reference link label lookup, and emphasis delimiter processing. These parsing paths perform super-linear work on crafted input. Attackers submit Markdown containing long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time. Applications that render user-supplied Markdown, such as forums, wikis, and comment systems, can be stalled by a single request. The issue is tracked under [CWE-407] (Inefficient Algorithmic Complexity).

Critical Impact
Unauthenticated network attackers can exhaust CPU resources on any service that parses attacker-controlled Markdown with vulnerable versions of league/commonmark.

Affected Products

thephpleague/commonmark versions prior to 2.9.1
PHP applications embedding league/commonmark for Markdown rendering
Downstream frameworks and CMS platforms that bundle league/commonmark

Discovery Timeline

2026-09-07 - CVE-2026-86430 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86430

Vulnerability Analysis

The advisory identifies three distinct parsing paths in league/commonmark that degrade to super-linear time on adversarial input. Fenced code block detection scans long runs of backtick characters and repeatedly attempts to match closing fences. Reference link label lookup walks nested bracket structures without effective bounds, so each additional nesting level multiplies work. Emphasis delimiter processing pairs * and _ runs in a manner that becomes quadratic when many candidate delimiters compete for pairing. A single request containing a few kilobytes of pathological Markdown can occupy a PHP worker for seconds. Concurrent requests then saturate the pool and block legitimate traffic. See the GitHub Security Advisory for full technical context.

Root Cause

The root cause is inefficient algorithmic complexity in three parser routines. The routines lack early-exit heuristics or memoization to bound work on repeated patterns. Input size does not correlate linearly with processing time, so standard request-size limits do not protect the application.

Attack Vector

Exploitation requires only the ability to submit Markdown to a vulnerable endpoint. No authentication, user interaction, or elevated privilege is needed. Any surface that accepts and renders Markdown, including issue trackers, comment forms, and API payloads, is reachable. The impact is limited to availability; confidentiality and integrity are not affected.

// No verified proof-of-concept has been published.
// Refer to the VulnCheck and GitHub advisories for technical detail.

Detection Methods for CVE-2026-86430

Indicators of Compromise

Sustained high CPU utilization in PHP-FPM or worker processes correlated with Markdown-processing endpoints.
Request payloads containing unusually long runs of backticks, unbalanced brackets, or repeated */_ delimiter sequences.
Elevated request latency and 502/504 responses from services that render user-submitted Markdown.

Detection Strategies

Inventory dependencies with composer show league/commonmark to identify installations below 2.9.1.
Add request-time instrumentation around the Markdown parser and alert on parse durations exceeding a low threshold, for example 250ms.
Deploy web application firewall rules that inspect Markdown request bodies for backtick runs and bracket nesting depth beyond safe limits.

Monitoring Recommendations

Track CPU time per request on endpoints that accept Markdown and baseline normal parser latency.
Monitor PHP worker saturation, queue depth, and 5xx error rates on affected services.
Log and rate-limit clients that repeatedly submit payloads triggering long parse times.

How to Mitigate CVE-2026-86430

Immediate Actions Required

Upgrade league/commonmark to version 2.9.1 or later using composer update league/commonmark.
Enforce a strict maximum size on Markdown request bodies at the reverse proxy or application layer.
Set a per-request CPU or wall-clock timeout on Markdown rendering to prevent worker exhaustion.

Patch Information

The maintainers fixed the three parsing paths in league/commonmark 2.9.1. Details and the fix commits are published in the GitHub Security Advisory GHSA-j8pm-gj4c-rq4x and the VulnCheck Denial of Service Advisory.

Workarounds

Reject Markdown submissions above a small size threshold, such as 64KB, until patching is possible.
Filter or normalize input to cap consecutive backticks and bracket nesting depth before parsing.
Move Markdown rendering to an isolated worker with strict CPU limits so a stalled parse cannot affect the primary application pool.

bash

# Upgrade to the patched release
composer require league/commonmark:^2.9.1
composer update league/commonmark