CVE-2026-111766

Name	CVE-2026-111766
Description	markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-markdown-it (PTS)	bookworm, trixie	22.2.3+dfsg+~12.2.3-2	vulnerable
	forky, sid	22.2.3+dfsg+~12.2.3-5	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-markdown-it	source	(unstable)	(unfixed)

Notes

https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q
Fixed by: https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79 (15.0.3)
Fixed by: https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503 (14.3.3)