Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

Published September 8, 2026 GHSA-j95f-988m-3j2f

Crafted Markdown can freeze apps using vulnerable versions of @tiptap/core. Repeated requests can stop servers from handling normal traffic.

Severity
Not scoredNo CVSS score recorded
Fix
Fixed in 3.30.5Fix recorded 3 days ago
Affected versions
3.7.0 or newer, but before 3.30.5
Affects
@tiptap/core

How it works

  • The app must process attacker-controlled Markdown using the affected helpers.
  • An attacker sends block or inline attributes deliberately built to trigger repeated scanning.
  • The package repeatedly checks the same text, consuming excessive processing power.
  • This can block a browser, server, or background worker.

What to do

Run npm ls --all @tiptap/core from the application directory. Results from 3.7.0 through 3.30.4 identify an affected version. Then confirm whether the app processes Markdown supplied by untrusted users. Finding the package alone does not prove the affected feature is exposed.

Run this in the application environment you want to check:

npm ls --all @tiptap/core

Update every affected @tiptap/core dependency copy to version 3.30.5. Rerun the version check and confirm no affected copy remains. For bundled software, ask its maintainer to confirm it includes the 3.30.5 fix.

Technical details

Two inefficient regular expressions in @tiptap/core repeatedly rescan crafted Markdown attributes. The required processing grows quadratically, allowing relatively small input to consume excessive CPU. The supported impact is loss of availability, not reading or changing data. Version 3.30.5 replaces the vulnerable processing and is the first patched release.

References

View Original Source