markdown‑it is a Markdown parser that, before versions 14.3.3 and 15.0.3, processes inline HTML when the html option or commonmark preset is enabled. Repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections inside a paragraph trigger a quadratic‑time search for a closing tag. The parser repeatedly rescans overlapping input, causing event‑loop blocking or an unresponsive browser main thread. The affected payloads only impact inline HTML parsing, so normal Markdown rendering and HTML blocks with html disabled are unaffected.

The vulnerability affects all installations of markdown‑it of any major version prior to 14.3.3 and 15.0.3 when the html option or commonmark preset is enabled. Users must identify the component version through package metadata and confirm whether inline HTML parsing is turned on.

The CVSS score of 3.7 indicates low severity, but the exploit is trivial for an attacker who can supply Markdown input, such as through an API endpoint or a blog post editor. The EPSS score is unavailable, and the issue is not listed in CISA KEV, but the denial‑of‑service nature may still be valuable to an attacker seeking to degrade service availability.