CVE-2026-111758

What it actually does

Unclosed link reference definition labels or titles trigger quadratic-time processing in reference.ts via repeated string concatenation and subsequent charCodeAt/slice operations that force V8 cons-string flattening before invalidation is detected.

Why it matters to the business

Attackers can remotely exhaust CPU resources on any service that parses untrusted Markdown, resulting in denial of service and degraded availability for applications or platforms relying on the affected parser versions.

How an attack unfolds

An attacker crafts a Markdown document containing a link reference definition whose label or title lacks a closing delimiter and submits it to any endpoint that invokes markdown-it with default options; the parser lazily accumulates continuation lines, repeatedly copying growing strings, until CPU exhaustion occurs without requiring authentication or special configuration.

How to fix it

Upgrade markdown-it to version 14.3.3 or 15.0.3; rebuild and redeploy all dependent applications; consider adding input size or complexity limits as a defense-in-depth measure until patching is complete.

How to confirm the fix worked

Confirm the installed version is at least 14.3.3 or 15.0.3 via package manifest or runtime inspection; test the parser against a known-bad unclosed reference payload and verify linear-time completion; review change logs for the reference.ts fix.

Typical attack path

1. Identify a target service accepting untrusted Markdown input processed by markdown-it
2. Craft a minimal payload with an unclosed link reference definition label or title
3. Submit the payload via network request or file upload
4. Observe sustained high CPU utilization on the parsing thread or worker until timeout or crash

How to detect it

Search application and web server logs for unusually large or repetitive Markdown submissions that trigger high CPU; monitor process CPU and memory metrics during parsing; review any custom Markdown sanitization or preprocessing logs for entries containing long unterminated bracket sequences.

What your security team should do

• Prioritize patching all instances within the next maintenance window given the public availability of the flaw six days after disclosure
• Inventory all direct and transitive dependencies on markdown-it across the ecosystem
• Implement request timeouts and resource limits on Markdown parsing endpoints as interim controls
• Add the patched versions to dependency update automation and vulnerability scanning policies