The vulnerability arises when markdown-it parses a link reference definition whose label or title is never closed. The parser’s default algorithm concatenates lines using lazy pull‑in and then performs charCodeAt and slice operations that trigger V8’s cons‑string flattening, causing a quadratic‑time growth in CPU and memory usage. This can lead to a denial of service by exhausting server resources. The weakness is classified as CWE-1046, CWE-400 and CWE-407.

markdown‑it, the JavaScript Markdown parser, is known to be vulnerable in versions 14.1.0 through 14.3.2 and 15.0.0 through 15.0.2 when using the default options. The issue has been addressed in v14.3.3 and v15.0.3, so any application that imports these earlier releases is at risk, especially web servers or services that render user‑supplied markdown.

With a CVSS score of 7.5 the vulnerability is considered high severity. The EPSS score is 0.00455, indicating a very low exploit probability, and the flaw is not in the CISA KEV catalog. Attack conditions are minimal: an attacker can embed a crafted, unclosed link reference definition in markdown sent to a parsing endpoint, triggering excessive CPU consumption. The exploit does not require privileged access or authentication, and no network or local privilege escalation is possible beyond the service’s process limits.