markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

Description

With html: true, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments (<!--), processing instructions (<?), declarations (<!A), and CDATA sections (<![CDATA[).

An attacker-controlled input of a few hundred kilobytes can block the Node.

Recommendation

Update the markdown-it package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 15.0.0, < 15.0.3

  < 14.3.3**

• Patched version(s): **15.0.3

  14.3.3**

References

• GHSA-vfgh-jcmw-g37q
• CVE-2026-111766
• CWE-400
• CWE-407
• CAPEC-310