High severity · published Sep 7, 2026
CVE-2026-86430
league/commonmark before 2.9.1 Denial of Service via parsing
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
commonmark · thephpleague
0.6.0 before 2.9.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86430
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86430
vendor-advisory
https://github.com/thephpleague/commonmark/security/advisories/GHSA-j8pm-gj4c-rq4x
third-party-advisory
https://www.vulncheck.com/advisories/league-commonmark-before-2.9.1-denial-of-service-via-parsing
More from commonmark
7.5
CVE-2026-105830
league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser
7.5
CVE-2024-58382
league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity
7.5
CVE-2026-86435
commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote
7.5
CVE-2026-86434
commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
7.5
CVE-2026-86433
commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes