HedgeDoc
CVE-2026-58486
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, reliably triggerable DoS needing only note-creation privilege (PR:L) and no user interaction; availability-only impact so C:N/I:N/A:H with scope unchanged.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, HedgeDoc was vulnerable to a YAML alias bomb due to unsafe processing of the note frontmatter. HedgeDoc parsed frontmatter with js-yaml.load (js-yaml v3) via @hedgedoc/meta-marked, which resolved YAML anchor aliases. A compact malicious payload could therefore expand into a huge object structure, consuming excessive CPU. This expansion ran on every request to the publish view (/s/<shortid>) and, when placed under the opengraph key, the editor view (/<noteId>). A ten-level alias bomb could block the single Node.js event loop for roughly 235 seconds per request, causing concurrent requests to hang or drop and rendering the instance unavailable (DoS). Because the note was stored in the database, the impact survived process restarts until the note was removed. toobusy-js did not reliably mitigate the worst cases, as the event loop was saturated before the middleware could respond. This issue was fixed in version 1.11.0.
Articles & Coverage 1
AnalysisAI
Denial of service in HedgeDoc before 1.11.0 lets a user who can store a note crash the instance by embedding a YAML "alias bomb" in the note frontmatter. Because HedgeDoc parsed frontmatter with the unsafe js-yaml v3 load (via @hedgedoc/meta-marked) and resolved anchor aliases, a compact ten-level payload expands into a massive object that blocks the single Node.js event loop for roughly 235 seconds on every request to the publish view (/s/<shortid>) or, under the opengraph key, the editor view (/<noteId>). No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, but the stored payload persists in the database and re-triggers after process restarts, making outages durable until the note is deleted.
Technical ContextAI
The root cause is CWE-400 (uncontrolled resource consumption) arising from unsafe YAML deserialization. HedgeDoc extracts note metadata by feeding the frontmatter block to js-yaml v3's load() through the @hedgedoc/meta-marked wrapper. js-yaml supports YAML anchors (&x) and aliases (*x); when aliases reference other aliases across many levels, each level multiplies the referenced structure, so a small text payload materializes into an exponentially large in-memory object graph. Building and holding that graph saturates CPU and monopolizes the single-threaded Node.js event loop. The remediating commit (c489497) confirms the mechanism: js-yaml is upgraded to v4 and, critically, parsing is wrapped in a custom splitFrontmatter routine plus constrain-object with maxDepth:4 and onCycle:'omit' to bound the resulting structure. The affected package is HedgeDoc (cpe:2.3:a:hedgedoc:hedgedoc), a Node.js/Express real-time collaborative markdown editor.
RemediationAI
Vendor-released patch: 1.11.0 - upgrade all HedgeDoc instances to 1.11.0 or later, which replaces js-yaml v3 with v4 and constrains parsed frontmatter via constrain-object (maxDepth:4, onCycle:'omit'), per commit c489497 and advisory GHSA-qj78-mjch-wwrv. If you cannot upgrade immediately, reduce exposure by restricting who can create or store notes (for example, tighten the anonymous/freeURL permission level so only trusted authenticated users can author notes), since exploitation requires a stored note; this trades off open or anonymous usage. You can also place the instance behind a reverse proxy that rate-limits and enforces short request timeouts on /s/<shortid> and /<noteId> so a single blocking request is cut off sooner, and audit existing stored notes for oversized or anchor/alias-laden frontmatter and delete offending notes (necessary because the payload persists across restarts). Note that toobusy-js is not a reliable control here, as the event loop saturates before the middleware can respond.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today