markdown-it quadratic performance degradation in linkify processing

Severity: medium · Published 2026-09-29

markdown-it is a JavaScript library that converts markdown text into HTML. When the linkify feature is enabled, specially crafted markdown can consume significant CPU resources and block application responsiveness for tens of seconds. An attacker who can provide markdown content to be processed—such as through a comment system or document upload—can trigger a denial of service affecting all users of the application.

Technologies: Markdown-It. Vendors: Markdown-It.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, published 29 September 2026.
Which products and versions are affected?
Markdown-It 15.0.0.
Is there a fix for This vulnerability?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Markdown-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from two independent quadratic-time code paths in linkify processing. The first is in src/rules_core/linkify.ts, which rebuilds the entire children array for each linkified token, resulting in O(N²) behavior on paragraphs with many soft-broken lines and email addresses. The second is in src/rules_inline/linkify.ts, where state.pending.match(SCHEME_RE) is called at every :// occurrence, rescanning ever-growing strings when unregistered schemes are encountered. Exploitation requires linkify to be enabled and ordinary-looking markdown containing repeated email addresses or unregistered schemes; the attack is purely a denial of service via CPU exhaustion.

Affected products

  • markdown-it markdown-it 15.0.0

Timeline

  • 2026-09-29: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.