Description
@tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated __QUOTED_0 prefixes.
Recommendation
Update the @tiptap/core package to the latest compatible version. Followings are version details:
- Affected version(s): >= 3.7.0, < 3.30.5
- Patched version(s): 3.30.5
References
Could your website be exposed too?
SmartScanner can check your website for Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing and gives you actionable findings to investigate.
Start a free scanRelated Issues
- markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled - CVE-2026-111766
- Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes - Vulnerability
- markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of sec - Vulnerability
- Marked ReDoS due to email addresses being evaluated in quadratic time - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated September 08, 2026