HedgeDoc CVE-2026-58486

The attacker must be able to store a note on the target instance (CVSS PR:L indicates a low-privilege/authenticated actor, though deployments that permit anonymous note creation lower this bar), and the note's frontmatter must contain a nested YAML anchor/alias structure (the description cites a ten-level alias bomb). Triggering then requires only an HTTP request to the note's publish view /s/<shortid>; the editor view /<noteId> is also affected when the payload is placed under the opengraph key. Limiting factors: exploitation is confined to HedgeDoc versions prior to 1.11.0, requires the ability to create/persist a note rather than pure unauthenticated access, and needs no interaction from any victim. There is no confidentiality or integrity impact - the outcome is availability loss only.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VA:H/SA:H, score 8.3) portrays a network-reachable, low-complexity, low-privilege attack with high availability impact and no confidentiality or integrity impact - consistent with a pure DoS. There is no EPSS score, KEV listing, or public POC in the supplied data, so exploitation is not confirmed in the wild; however, the technical detail (a ~235-second event-loop stall per request that defeats the toobusy-js safeguard, which cannot respond because the loop saturates first) shows the bug is reliably and cheaply triggerable once an attacker can store a note. The standout risk factor is persistence: the malicious note lives in the database and survives restarts, so a single successful write causes a durable outage rather than a transient spike - this raises real-world priority above a typical reflected DoS. Because there is no data compromise, priority should be weighed against how exposed the publish endpoint is and whether note creation is open to anonymous or low-trust users on a given deployment.

An attacker with permission to create a note authors one whose YAML frontmatter contains a ten-level anchor/alias bomb, then requests the note's publish URL (/s/<shortid>). Each such request expands the payload into a huge object and blocks the Node.js event loop for about 235 seconds, hanging or dropping all concurrent users' requests; leaving the stored note in place keeps the instance down across restarts. No public exploit code has been identified, but the payload is trivial to construct from the advisory description.