CVE-2026-111758

Name	CVE-2026-111758
Description	markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-markdown-it (PTS)	bookworm, trixie	22.2.3+dfsg+~12.2.3-2	fixed
	forky, sid	22.2.3+dfsg+~12.2.3-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-markdown-it	source	(unstable)	(not affected)

Notes

- node-markdown-it <not-affected> (Vulnerable code introduced later)
https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r23c
Fixed by: https://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22deaf8f1eca (15.0.3)
Fixed by: https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503 (14.3.3)