league/commonmark parsed several constructs in quadratic time, any of which can be abused for denial of service: catastrophic backtracking in the fenced code block start pattern made a single line of backticks quadratic; shortcut reference link lookups normalized arbitrarily long labels once one reference definition was present, resolving nested brackets quadratically; and delimiter processors keyed an unbounded openersBottom cache. Fixed in 2.9.1 by anchoring the fenced code pattern, applying the spec's 999-character link label limit when resolving references, and bounding the delimiter cache key space.