What is GHSA-253C-MCHW-3W2R?

GHSA-253C-MCHW-3W2R is a medium-severity uncontrolled resource consumption vulnerability in markdown-it (npm), affecting versions = 15.0.0. It is fixed in 15.0.1, 14.3.1. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.

Which versions of markdown-it are affected by GHSA-253C-MCHW-3W2R?

markdown-it (npm) versions = 15.0.0 is affected.

Is there a fix for GHSA-253C-MCHW-3W2R?

Yes. GHSA-253C-MCHW-3W2R is fixed in 15.0.1, 14.3.1. Upgrade to this version or later.

Is GHSA-253C-MCHW-3W2R exploitable, and should I be worried?

Whether GHSA-253C-MCHW-3W2R is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether GHSA-253C-MCHW-3W2R is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix GHSA-253C-MCHW-3W2R?

Upgrade: markdown-it to 15.0.1 or later, markdown-it to 14.3.1 or later.

GHSA-253C-MCHW-3W2R in markdown-it

Summary

markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads.

src/rules_core/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each time. A paragraph of N soft-broken lines is one inline token with about 2N children, so you get N rebuilds over a 2N array. Schema-less emails are what reach it. A http:// link gets consumed by the inline rule first and never arrives as a text token, so those stay linear.

src/rules_inline/linkify.ts runs state.pending.match(SCHEME_RE) at every :// in the source. state.pending only gets truncated once a link is actually produced, so an unregistered scheme leaves it growing and every :// rescans the lot.

Proof of concept

Clean install of 15.0.0 from npm, new MarkdownIt({ linkify: true }).render(payload), Node 24.

N	5,000	10,000	20,000	40,000
`'[email protected]\n'.repeat(N)`, 34KB to 273KB	1.1s	4.7s	19.6s	89s
`'a://'.repeat(N)`, 20KB to 156KB	0.25s	0.76s	3.1s	15.0s

Doubling the input roughly quadruples the time in both. With linkify: false the same inputs run in 25 to 131ms and stay flat.

Controls for the first one, all at N=20000: putting every email in a single text token ('[email protected] ') takes 0.59s, one email per paragraph ('[email protected]\n\n') takes 0.64s, and soft-broken lines with nothing linkifiable take 42ms. So it needs many children AND many of them linkifying. For the second, replaying just the SCHEME_RE calls against the same growing prefixes with no markdown-it involved accounts for 11.7s of the 15s.

Ordinary prose does it too. 'ping [email protected] ok\n'.repeat(20000) is 293KB and takes 31s.

Caveat

linkify is off by default, so this only reaches apps that turn it on.

Impact

Availability only. A few hundred KB of fairly ordinary markdown pins one core for tens of seconds, and because it's quadratic it degrades quickly with size. Nothing is read, written or executed.

Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.

Affected versions

markdown-it (= 15.0.0) markdown-it (< 14.3.1)

Security releases

markdown-it → 15.0.1 (npm) markdown-it → 14.3.1 (npm)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Upgrade the following packages to resolve this vulnerability:

markdown-it to 15.0.1 or later; markdown-it to 14.3.1 or later

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is GHSA-253C-MCHW-3W2R? GHSA-253C-MCHW-3W2R is a medium-severity uncontrolled resource consumption vulnerability in markdown-it (npm), affecting versions = 15.0.0. It is fixed in 15.0.1, 14.3.1. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
Which versions of markdown-it are affected by GHSA-253C-MCHW-3W2R? markdown-it (npm) versions = 15.0.0 is affected.
Is there a fix for GHSA-253C-MCHW-3W2R? Yes. GHSA-253C-MCHW-3W2R is fixed in 15.0.1, 14.3.1. Upgrade to this version or later.
Is GHSA-253C-MCHW-3W2R exploitable, and should I be worried? Whether GHSA-253C-MCHW-3W2R is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether GHSA-253C-MCHW-3W2R is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix GHSA-253C-MCHW-3W2R?
- Upgrade markdown-it to 15.0.1 or later
- Upgrade markdown-it to 14.3.1 or later

Other vulnerabilities in markdown-it

CVE-IDSeverityPackage summary

CVE-2026-111758Highmarkdown-it: markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)CVE-2026-111766Lowmarkdown-it: markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled CVE-2026-111759Highmarkdown-it: markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes CVE-2026-48988Mediummarkdown-it: markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations CVE-2026-2327Mediummarkdown-it: markdown-it is has a Regular Expression Denial of Service (ReDoS)