{"action":"Upgrade markdown-it to 14.3.1 or later.","affected":[{"fixed":"15.0.1","introduced":"15.0.0"},{"fixed":"14.3.1","introduced":"0"}],"component":"markdown-it","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["15.0.1","14.3.1"],"ghsa_id":"GHSA-253c-mchw-3w2r","id":"tcs_01M5KERZ1FQ5509WEG8Q346CBB","modified_at":"2026-09-29T18:15:04.692324591Z","published_at":"2026-09-29T17:57:56Z","references":["https://osv.dev/vulnerability/GHSA-253c-mchw-3w2r","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-253c-mchw-3w2r","https://github.com/markdown-it/markdown-it/commit/09fa07118dda4c953f058848f53dae88395618ca","https://github.com/markdown-it/markdown-it/commit/aaadcfa6d817b3c5f89afb49d97c7b797a6dd4fd","https://github.com/markdown-it/markdown-it/commit/ad70f6b7cff64bee10e42a774147112480ca0d49","https://github.com/markdown-it/markdown-it"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-253c-mchw-3w2r","url":"https://osv.dev/vulnerability/GHSA-253c-mchw-3w2r"}],"summary":"markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds"}