Executive brief
Tiptap is a popular rich-text editor framework used in many web applications to enable users to create and edit formatted content. The vulnerability allows attackers to craft specially-formatted Markdown documents that cause the editor's parsing logic to consume excessive CPU resources, freezing the application on both client and server. Malicious documents can be persisted to repeatedly freeze users, or sent as requests to exhaust server processing capacity and cause denial of service.
Technical details
Tiptap's default Markdown attribute parsers contain two separate quadratic regular-expression denial-of-service (ReDoS) vulnerabilities. The block attribute parser in attributeUtils.ts uses unanchored greedy expressions that rescan repeated `__QUOTED_0` prefixes with O(n²) complexity; the inline attribute parser in createInlineMarkdownSpec.ts rescans a long word-character run when no equals sign follows. Both are triggered by crafted Markdown input with no authentication required. An attacker can craft a 20,508-byte atom-block token that takes ~1.4 seconds to parse (vs 0.29ms for benign input) or a 32,776-byte inline token that takes ~2.2 seconds (vs 0.19ms for control). The vulnerability was introduced in version 3.7.0 (October 2025) and patched in version 3.30.5; affected versions from 3.7.0 through 3.29.2 and repository main remain vulnerable.
Affected products
- Tiptap @tiptap/core 3.7.0 through 3.29.2; fixed in 3.30.5
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in version 3.30.5