GHSA-vfgh-jcmw-g37q markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

• npm markdown-it: < 14.3.3 → fixed in 14.3.3 • npm markdown-it: >= 15.0.0, < 15.0.3 → fixed in 15.0.3

Summary With `html: true`, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments (``, `?>`, `>`, and `]]>`. When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again. Repeating this across the paragraph produces quadratic total work. For these inputs, the problem is repeated scanning across separate matches. The payload must reach inline parsing. Prefixing it with `x ` keeps it inside a paragraph. Starting a line directly with one of these constructs instead invokes HTML block parsing, which does not exhibit the same repeated inline scans for these payloads. The existing `unclosed '.repeat(n)], 'HTML block': [mdHtml, '<!--'.repeat(n)], 'Plain text': [mdHtml, 'x ' + 'abcd'.repeat(n)] } for (const [name, [md, src]] of Object.entries(controls)) { console.log({ control: name, ms: measure(md, src) }) } const repoPayload = '</' + '<!--'.repeat(100000) console.log({ payload: 'Existing pathological test', htmlFalseMs: measure(mdDefault, repoPayload), htmlTrueMs: measure(mdHtml, repoPayload) }) ``` Measurements from the original report on `[email protected]`, Node.js 20: | Construct | 8,000 repetitions | 64,000 repetitions | | --- | ---: | ---: | | Comment | 170 ms | 8,799 ms | | Processing instruction | 26 ms | 1,566 ms | | Declaration | 93 ms | 5,628 ms | | CDATA | 119 ms | 4,179 ms | An eightfold increase in repetitions produces approximately 35–60 times the execution time, consistent with quadratic growth becoming dominant. For the comment payload at 64,000 repetitions: • HTML disabled: 25 ms. • Closed comments: 29 ms. • Payload at the start of an HTML block: 1 ms. • Plain text: 1 ms. The existing pathological-test payload with 100,000 comment openers took 33 ms with HTML disabled and 21,030 ms with HTML enabled. A separate comment payload with 128,000 repetitions, approximately 500 KiB, took 32,847 ms. Exact timings depend on the runtime and hardware. Impact This is an availability issue affecting applications that render attacker-controlled Markdown with `html: true`, including applications using the `commonmark` preset. On Node.js, a synchronous `render()` call can occupy a CPU core and block the event loop for seconds or tens of seconds, delaying other requests handled by the same process. Repeated submissions can cause denial of service. Browser applications can similarly become unresponsive when rendering on the main thread. Sanitizing the generated HTML afterwards does not prevent the issue because the expensive processing occurs during Markdown rendering. The default configuration, with HTML disabled, is unaffected by these payloads. Disabling HTML or limiting input size can reduce exposure while a fix is prepared. The reported affected release is `15.0.2`; the full affected version range has not been established.