[dependabot]

Bumps markdown-it from 14.3.2 to 14.3.3 in openam-ui/openam-ui-ria (package-lock.json only), clearing Dependabot alerts #372 and #373. This follows #1151, which took the same dependency from 14.2.0 to 14.3.2 for GHSA-253c-mchw-3w2r and GHSA-r7fv-28h4-cvq7 (the latter has since been assigned CVE-2026-111759); 14.3.3 backports the two security fixes of 15.0.3. openam-ui-ria is the only lock file in the repository that resolves markdown-it.

Advisories

Both are algorithmic-complexity denials of service in markdown-it's own parser: a few hundred kilobytes of input block the Node.js event loop, or a browser's main thread, for seconds to minutes.

CVE-2026-111758 / GHSA-gfr2-rv44-r23c (fixed in 14.3.3) — Uncontrolled resource consumption (CWE-400) through inefficient algorithmic complexity (CWE-407) in the block reference rule, reachable with default options. A link reference definition whose label or title is never closed pulls in continuation lines with str += lineContent; each following charCodeAt / slice flattens V8's cons-string and copies everything collected so far, so one definition spanning n lines costs O(n²) before the rule even decides it is invalid ('[a]: /u "' + 'x\n'.repeat(n): 400 KB → ~18 s, 800 KB → ~74 s). It is a regression introduced in 14.0 by markdown-it/markdown-it#1004; 13.0.2 handled the same 313 KB input in 125 ms. 14.3.3 scans state.src in place instead of building the string, and rejects labels over CommonMark's 999-code-point limit (markdown-it@48fbc46 on 15.x, backported in markdown-it@d99f488).

CVE-2026-111766 / GHSA-vfgh-jcmw-g37q (fixed in 14.3.3) — Same weakness (CWE-400 / CWE-407) in the inline html_inline rule, reachable only with html: true (which the commonmark preset also turns on). Inside a paragraph, every unterminated HTML comment (<!--), processing instruction (<?), declaration (<!A) or CDATA section (<![CDATA[) made the anchored HTML_TAG_RE scan the rest of the input for a terminator that is not there, and the next opener rescanned an overlapping suffix — 64,000 <!-- openers take ~8.8 s. 14.3.3 scans these constructs with indexOf and, after the first missing terminator, sets skipHtmlSpecial on the inline state so the rest of the paragraph is not rescanned (markdown-it@928bc8c on 15.x, backported in markdown-it@d99f488).

	Severity	Affected (14.x line)	Fixed in
GHSA-gfr2-rv44-r23c	High — CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)	>= 14.1.0, < 14.3.3	14.3.3
GHSA-vfgh-jcmw-g37q	Low — CVSS 3.1 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)	< 14.3.3	14.3.3

Availability-only: no code execution, no data exposure.

Impact on OpenAM

None at runtime, none in the build. markdown-it is a transitive development dependency of openam-ui-ria (dev: true): the single copy in the lock file comes from jsdoc 4.0.4, and jsdoc runs only from the manual npm run jsdoc script. The Maven build runs build:production (grunt prod) and test (grunt karma:build), neither of which calls jsdoc; no OpenAM source imports markdown-it, and it does not ship in the RIA bundle or the WAR.

Under npm run jsdoc both rules are active — jsdoc 4.0.4 builds its renderer as new MarkdownIt({ breaks, highlight, html: true }), and the reference rule is always on — but nothing attacker-controlled reaches them. config/jsdoc/configuration.json loads no plugins and no tutorials, so the only Markdown jsdoc renders is the repository's own README.md (opts.readme); the plugins/markdown plugin that would also pass doc comments through markdown-it is not enabled. The bump takes the development toolchain out of the vulnerable range.

Change

The node_modules/markdown-it entry in openam-ui/openam-ui-ria/package-lock.json: 14.3.2 → 14.3.3 (version, resolved, integrity). Its declared dependencies are unchanged, so no other entry moves. package.json is untouched — jsdoc@4.0.4 asks for markdown-it@^14.1.0, which 14.3.3 satisfies. No code change.

Verified:

• the lock file integrity matches npm view markdown-it@14.3.3 dist.integrity
• openam-ui-ria is the only lock file in openam-ui that resolves markdown-it
• the GitHub Advisory Database lists no advisory affecting markdown-it@14.3.3

References

• GHSA-gfr2-rv44-r23c
• GHSA-vfgh-jcmw-g37q
• https://nvd.nist.gov/vuln/detail/CVE-2026-111766
• markdown-it/markdown-it@48fbc46
• markdown-it/markdown-it@928bc8c
• markdown-it/markdown-it@d99f488
• https://github.com/markdown-it/markdown-it/releases/tag/14.3.3
• markdown-it/markdown-it@14.3.2...14.3.3