Repository navigation
GHSA-253c-mchw-3w2r GHSA-r7fv-28h4-cvq7 markdown-it: Quadratic-time DoS in linkify and smartquotes (14.2.0 -> 14.3.2) - #1151
Merged
vharseko merged 1 commit intoSep 30, 2026
Conversation
Bumps [markdown-it](https://github.com/markdown-it/markdown-it) from 14.2.0 to 14.3.2. - [Changelog](https://github.com/markdown-it/markdown-it/blob/14.3.2/CHANGELOG.md) - [Commits](markdown-it/markdown-it@14.2.0...14.3.2) --- updated-dependencies: - dependency-name: markdown-it dependency-version: 14.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
vharseko
changed the title
vharseko
approved these changes
Sep 30, 2026
vharseko
deleted the
dependabot/npm_and_yarn/openam-ui/openam-ui-ria/markdown-it-14.3.2
branch
September 30, 2026 15:50
vharseko
pushed a commit
that referenced
this pull request
Oct 21, 2026
…lti-line reference definitions and inline HTML (14.3.2 -> 14.3.3) (#1191) Bumps `markdown-it` from 14.3.2 to 14.3.3 in `openam-ui/openam-ui-ria` (`package-lock.json` only), clearing Dependabot alerts #372 and #373. This follows #1151, which took the same dependency from 14.2.0 to 14.3.2 for GHSA-253c-mchw-3w2r and GHSA-r7fv-28h4-cvq7 (the latter has since been assigned CVE-2026-111759); 14.3.3 backports the two security fixes of 15.0.3. `openam-ui-ria` is the only lock file in the repository that resolves `markdown-it`. ## Advisories Both are algorithmic-complexity denials of service in markdown-it's own parser: a few hundred kilobytes of input block the Node.js event loop, or a browser's main thread, for seconds to minutes. **CVE-2026-111758 / GHSA-gfr2-rv44-r23c** (fixed in 14.3.3) — Uncontrolled resource consumption (CWE-400) through inefficient algorithmic complexity (CWE-407) in the block `reference` rule, reachable with default options. A link reference definition whose label or title is never closed pulls in continuation lines with `str += lineContent`; each following `charCodeAt` / `slice` flattens V8's cons-string and copies everything collected so far, so one definition spanning n lines costs O(n²) before the rule even decides it is invalid (`'[a]: /u "' + 'x\n'.repeat(n)`: 400 KB → ~18 s, 800 KB → ~74 s). It is a regression introduced in 14.0 by markdown-it/markdown-it#1004; 13.0.2 handled the same 313 KB input in 125 ms. 14.3.3 scans `state.src` in place instead of building the string, and rejects labels over CommonMark's 999-code-point limit (markdown-it@48fbc46 on 15.x, backported in markdown-it@d99f488). **CVE-2026-111766 / GHSA-vfgh-jcmw-g37q** (fixed in 14.3.3) — Same weakness (CWE-400 / CWE-407) in the inline `html_inline` rule, reachable only with `html: true` (which the `commonmark` preset also turns on). Inside a paragraph, every unterminated HTML comment (`<!--`), processing instruction (`<?`), declaration (`<!A`) or CDATA section (`<![CDATA[`) made the anchored `HTML_TAG_RE` scan the rest of the input for a terminator that is not there, and the next opener rescanned an overlapping suffix — 64,000 `<!--` openers take ~8.8 s. 14.3.3 scans these constructs with `indexOf` and, after the first missing terminator, sets `skipHtmlSpecial` on the inline state so the rest of the paragraph is not rescanned (markdown-it@928bc8c on 15.x, backported in markdown-it@d99f488). | | Severity | Affected (14.x line) | Fixed in | |---|---|---|---| | GHSA-gfr2-rv44-r23c | High — CVSS 3.1 7.5 (`AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`) | >= 14.1.0, < 14.3.3 | 14.3.3 | | GHSA-vfgh-jcmw-g37q | Low — CVSS 3.1 3.7 (`AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L`) | < 14.3.3 | 14.3.3 | Availability-only: no code execution, no data exposure. ## Impact on OpenAM None at runtime, none in the build. `markdown-it` is a transitive development dependency of `openam-ui-ria` (`dev: true`): the single copy in the lock file comes from `jsdoc` 4.0.4, and `jsdoc` runs only from the manual `npm run jsdoc` script. The Maven build runs `build:production` (`grunt prod`) and `test` (`grunt karma:build`), neither of which calls `jsdoc`; no OpenAM source imports `markdown-it`, and it does not ship in the RIA bundle or the WAR. Under `npm run jsdoc` both rules are active — jsdoc 4.0.4 builds its renderer as `new MarkdownIt({ breaks, highlight, html: true })`, and the `reference` rule is always on — but nothing attacker-controlled reaches them. `config/jsdoc/configuration.json` loads no plugins and no tutorials, so the only Markdown jsdoc renders is the repository's own `README.md` (`opts.readme`); the `plugins/markdown` plugin that would also pass doc comments through markdown-it is not enabled. The bump takes the development toolchain out of the vulnerable range. ## Change The `node_modules/markdown-it` entry in `openam-ui/openam-ui-ria/package-lock.json`: 14.3.2 → 14.3.3 (`version`, `resolved`, `integrity`). Its declared dependencies are unchanged, so no other entry moves. `package.json` is untouched — `jsdoc@4.0.4` asks for `markdown-it@^14.1.0`, which 14.3.3 satisfies. No code change. Verified: - the lock file `integrity` matches `npm view markdown-it@14.3.3 dist.integrity` - `openam-ui-ria` is the only lock file in `openam-ui` that resolves `markdown-it` - the GitHub Advisory Database lists no advisory affecting `markdown-it@14.3.3` ## References - GHSA-gfr2-rv44-r23c - GHSA-vfgh-jcmw-g37q - https://nvd.nist.gov/vuln/detail/CVE-2026-111766 - markdown-it/markdown-it@48fbc46 - markdown-it/markdown-it@928bc8c - markdown-it/markdown-it@d99f488 - https://github.com/markdown-it/markdown-it/releases/tag/14.3.3 - markdown-it/markdown-it@14.3.2...14.3.3 Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps
markdown-itfrom 14.2.0 to 14.3.2 inopenam-ui/openam-ui-ria(package-lock.jsononly), clearing Dependabot alert #348 for this lock file; the same bump also fixes a second upstream advisory that has no Dependabot alert yet.Advisories
GHSA-253c-mchw-3w2r (fixed in 14.3.1, no CVE yet) — Uncontrolled resource consumption (CWE-400) through inefficient algorithmic complexity (CWE-407) in the
linkify: truehandling, in markdown-it's own code rather than inlinkify-it. Two independent quadratic paths: the core linkify rule callsarrayReplaceAtonce per linkified text token and rebuilds the wholechildrenarray each time, so a paragraph of N soft-broken lines with schema-less e-mails costs N rebuilds of a 2N array ('a@b.co\n'.repeat(20000), 273 KB → ~20 s); and the inline linkify rule matchesSCHEME_REagainst the ever-growingstate.pendingat every://, so an unregistered scheme rescans the lot ('a://'.repeat(40000), 156 KB → ~15 s). 14.3.1 backports the 15.0.1 fixes.GHSA-r7fv-28h4-cvq7 (fixed in 14.3.2, no CVE yet) — Quadratic complexity (CWE-400 / CWE-407) in the smartquotes rule with
typographer: true: many opening double quotes followed by unmatched closing single quotes (or the reverse) rescan the whole opener stack every time —'"a '.repeat(k) + "b' ".repeat(k)takes ~1.6 s at 192 KB and grows quadratically. This is a different path from the smartquotesreplaceAtissue fixed in 14.2.0 (CVE-2026-48988). 14.3.2 backports the 15.0.2 fix (markdown-it/markdown-it#1209), which also caps the smartquotes stack at 1000 unmatched openers. The advisory is published in the markdown-it repository but has not reached the GitHub Advisory Database yet, hence no Dependabot alert.AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)Both are availability-only: no code execution, no data exposure. Both need an option that is off by default (
linkify/typographer).Impact on OpenAM
None at runtime, none in the build.
markdown-itis a transitive development dependency ofopenam-ui-ria(dev: true): the single copy in the lock file comes fromjsdoc4.0.4 (plus its ownmarkdown-it-anchor), andjsdocis used only by the manualnpm run jsdocscript. The Maven build runsbuild:production(grunt prod) andtest(grunt karma:build), neither of which callsjsdoc; no OpenAM source importsmarkdown-itand it does not ship in the RIA bundle or the WAR. Even undernpm run jsdocthe vulnerable paths are unreachable:jsdocbuilds its renderer asnew MarkdownIt({ breaks, highlight, html: true }), leavinglinkifyandtypographerat theirfalsedefaults, and it renders only the repository's ownREADME.mdand doc comments fromsrc/main/js. The bump takes the development toolchain out of the vulnerable range.Change
The
node_modules/markdown-itentry inopenam-ui/openam-ui-ria/package-lock.json: 14.2.0 → 14.3.2 (version,resolved,integrity), plus its declared rangesentities^4.4.0→^4.5.0andlinkify-it^5.0.1→^5.0.2. Both are already satisfied by the copies in the lock file (entities4.5.0,linkify-it5.0.2 since #1078), so no other entry moves.package.jsonis untouched —jsdoc@4.0.4asks formarkdown-it@^14.1.0, which 14.3.2 satisfies. No code or behaviour change.Verified:
integritymatchesnpm view markdown-it@14.3.2 dist.integrityopenam-ui-riais the only lock file inopenam-uithat resolvesmarkdown-itReferences