---
id: CVE-2026-86430
title: >-
  league/commonmark versions before 2.9.1 contain multiple denial of service
  vulnerabilities in fenced code block detection, reference link label lookup,
  and emphasis delimiter processing that perform super-linear work on crafted
  input
summary: >-
  league/commonmark versions before 2.9.1 contain multiple denial of service
  vulnerabilities in fenced code block detection, reference link label lookup,
  and emphasis delimiter processing that perform super-linear work on crafted
  input. At…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-407
vendor: thephpleague
product: commonmark
affected:
  - commonmark < 2.9.1
patched:
  - commonmark 2.9.1
published: '2026-09-07'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T19:19:38.113'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86430'
references:
  - url: >-
      https://github.com/thephpleague/commonmark/security/advisories/GHSA-j8pm-gj4c-rq4x
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/league-commonmark-before-2.9.1-denial-of-service-via-parsing
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00493
epssPercentile: 0.39789
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-09T14:31:04.144121Z'
ingestedAt: '2026-09-08T20:10:03.179Z'
---

## Overview

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.

## Affected

- `commonmark < 2.9.1`

## Remediation

Upgrade past the affected range:

- `commonmark 2.9.1`