To securely report a vulnerability, please open an advisory on the affected GitHub repository. All repositories allow reporting vulnerabilities by clicking on the "New Issue" button.
Repository navigation
Security: markdown-it/markdown-it
Security
SECURITY.md
-
Quadratic-time denial of service in inline HTML parsing with html enabledGHSA-vfgh-jcmw-g37q published
Oct 16, 2026 by puzrinLow -
Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)GHSA-gfr2-rv44-r23c published
Oct 16, 2026 by puzrinHigh -
Quadratic complexity in smartquotes with unmatched closing quotesGHSA-r7fv-28h4-cvq7 published
Sep 12, 2026 by puzrinHigh -
linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of secondsGHSA-253c-mchw-3w2r published
Aug 27, 2026 by puzrinModerate -
Quadratic complexity DoS in smartquotes rule via replaceAt string operationsGHSA-6v5v-wf23-fmfq published
May 23, 2026 by puzrinModerate -
Possible ReDOS in newline ruleGHSA-6vfc-qv3f-vr6c published
Jan 8, 2022 by puzrinModerate
Learn more about advisories related to markdown-it/markdown-it in the GitHub Advisory Database