ghsa:GHSA-253C-MCHW-3W2R: markdown-it = 15.0.0, < 14.3.1

markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds. Affected range: = 15.0.0. Fixed version: 15.0.1. Affected range: < 14.3.1. Fixed version: 14.3.1.

Affected technology

markdown-it · = 15.0.0
Vendor not specified by the source

markdown-it · < 14.3.1
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

The source does not specify what an attacker can achieve.

Published 22-Oct-2026 20:58 UTC

Product: markdown-it
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-22 20:55:42.144132+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-253c-mchw-3w2r.html