Hi,

The following vulnerability was published for node-markdown-it.

CVE-2026-111766[0]:
| markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when
| the html option or commonmark preset is enabled and the constructs
| occur inside a paragraph, attacker-controlled Markdown containing
| repeated unterminated inline HTML comments, processing instructions,
| declarations, or CDATA sections reaches
| src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the
| remaining suffix for the appropriate terminator; when no terminator
| is present, parsing advances to the next opener and repeats the
| match over overlapping input, causing quadratic processing and
| denial of service through event-loop blocking or an unresponsive
| browser main thread. HTML blocks and the default HTML-disabled
| configuration are not affected by these payloads. This issue is
| fixed in versions 14.3.3 and 15.0.3.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-111766
https://www.cve.org/CVERecord?id=CVE-2026-111766
[1] https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore