← Back to the live CVE advisory feed

CVE-2026-86434: commonmark

Severity

8.7 (HIGH)

Vendor

THEPHPLEAGUE

Affected versions

2.0.0 through before 2.8.4

Fixed version

2.8.4

Patch status

Patched

Published

2026-09-07T13:20:42.870

Modified

2026-09-07T13:20:42.870

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.

View the official NVD record for CVE-2026-86434

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.