# CVE-2026-111766: markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

Source: https://junglewise.ai/threats/cve-2026-111766-markdown-it-is-a-markdown-parser-prior-to-14-3-3-and-15-0-3-when  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-111766 · Severity: low · CVSS 3.7 · Published 2026-10-19

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.

Technologies: [markdown-it (npm)](https://junglewise.ai/threats/technologies/markdown-it). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-111766 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111766 being exploited in the wild.

**How severe is CVE-2026-111766?** Low severity, with a CVSS score of 3.7, published 19 October 2026.

**Which products and versions are affected?** markdown-it (npm) < 14.3.3, SEMVER:introduced=0,fixed=14.3.3.

**Is there a fix for CVE-2026-111766?** Yes. markdown-it (npm): upgrade to 14.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-111766?** Check whether you run markdown-it (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- markdown-it (npm): upgrade to 14.3.3 or later

  ```sh
  npm install markdown-it@14.3.3
  ```


## Affected products

- markdown-it (npm) < 14.3.3, SEMVER:introduced=0,fixed=14.3.3

## Identifiers

- CVE-2026-111766
- GHSA-vfgh-jcmw-g37q

## Related threats

- [markdown-it quadratic-time rendering of unclosed link reference](https://junglewise.ai/threats/cve-2026-111758-markdown-it-quadratic-time-rendering-of-a-single-multi-line-link)
- [markdown-it quadratic ReDoS in smartquotes](https://junglewise.ai/threats/cve-2026-111759-markdown-it-is-a-markdown-parser-prior-to-14-3-2-and-15-0-2-when)
- [markdown-it denial of service in smartquotes rule](https://junglewise.ai/threats/cve-2026-48988-markdown-it-denial-of-service-in-smartquotes-rule)
- [markdown-it ReDoS in linkify regex](https://junglewise.ai/threats/cve-2026-2327-markdown-it-redos-in-linkify-function)
- [markdown-it inefficient regular expression complexity](https://junglewise.ai/threats/cve-2015-10005-markdown-it-inefficient-regular-expression-complexity)