Disclosure summary
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.
Source-reported weakness categories
CWE-407
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-86430
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| thephpleague | commonmark | * {"versionEndExcluding":"2.9.1"} |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Mitigation, Patch, Vendor Advisory
- www.vulncheck.com — Third Party Advisory
PUBLISHED 2026-09-07T09:20:42-04:00
MODIFIED 2026-10-08T12:17:57-04:00
INGESTED 2026-10-10T20:50:36-04:00