CVE-2026-111766: markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

CVE-2026-111766 · Severity: low · CVSS 3.7 · Published 2026-10-19

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.

Technologies: markdown-it (npm). Vendors: npm.

Quick answers

Is CVE-2026-111766 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-111766 being exploited in the wild.
How severe is CVE-2026-111766?
Low severity, with a CVSS score of 3.7, published 19 October 2026.
Which products and versions are affected?
markdown-it (npm) < 14.3.3, SEMVER:introduced=0,fixed=14.3.3.
Is there a fix for CVE-2026-111766?
Yes. markdown-it (npm): upgrade to 14.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-111766?
Check whether you run markdown-it (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • markdown-it (npm): upgrade to 14.3.3 or later
    npm install markdown-it@14.3.3

Affected products

  • markdown-it (npm) < 14.3.3, SEMVER:introduced=0,fixed=14.3.3

Identifiers

  • CVE-2026-111766
  • GHSA-vfgh-jcmw-g37q

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.