CVE-2026-111759 in markdown-it
Summary
by MITRE • 10/19/2026
markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. This issue is fixed in versions 14.3.2 and 15.0.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified within the markdown-it library represents a significant availability risk stemming from algorithmic complexity flaws in its text processing engine. Specifically, this flaw resides in the smartquotes rule which is activated when the typographer configuration option is set to true. This feature is designed to enhance readability by converting standard ASCII punctuation marks into their corresponding typographic equivalents, such as curly quotes and ellipses. While this functionality improves document aesthetics for trusted content, it introduces a critical performance bottleneck when processing untrusted or maliciously crafted input. The core technical issue involves the internal logic used to match opening quote characters with their closing counterparts. In versions prior to 14.3.2 and 15.0.2, the algorithm employs a stack-based approach to track open quotes that have not yet been closed. When processing text containing sequences of multiple opening double quotes followed by unmatched single closing quotes, or vice versa, the parser fails to efficiently resolve these mismatches. Instead of terminating early upon detecting an invalid sequence, the engine repeatedly rescans the entire opener stack for each subsequent character in the malformed input string.
This inefficient handling results in quadratic time complexity relative to the length of the malicious input. In practical terms, this means that as the size of the untrusted Markdown content increases, the processing time grows exponentially rather than linearly. For an attacker, this behavior can be exploited to trigger a Denial of Service condition against applications that rely on markdown-it for rendering user-generated content. By submitting carefully crafted payloads consisting of long sequences of mismatched quotes, an adversary can consume excessive CPU resources and memory, effectively freezing the application or causing it to crash. This is particularly dangerous because many web services enable the typographer option by default or through common configuration presets to improve the visual quality of rendered text. Consequently, systems that accept user input in Markdown format without strict sanitization are highly susceptible to this resource exhaustion attack vector.
From a classification perspective, this vulnerability aligns with CWE-400, which denotes Uncontrolled Resource Consumption, specifically manifesting as a ReDoS-like behavior due to inefficient algorithmic complexity rather than traditional regular expression backtracking. It also maps to the ATT&CK technique of T1496, Resource Hijacking, where an attacker compromises system resources through computational exhaustion. The impact extends beyond simple performance degradation; in server-side rendering environments or real-time chat applications, this vulnerability can lead to service unavailability for all users sharing a compute instance with the affected process. It highlights the critical importance of validating input complexity and ensuring that parsing libraries are configured securely by default.
Mitigation strategies must prioritize immediate software updates as well as defensive coding practices. The primary remediation is to upgrade markdown-it to version 14.3.2 or later, where the quadratic processing flaw has been resolved through optimized stack management logic. For environments unable to update immediately, administrators should consider disabling the typographer option if high-fidelity typography conversion is not strictly required for their use case. Additionally, implementing input length limits and timeout mechanisms on the parsing process can provide a layer of defense against resource exhaustion attacks. It is also advisable to sanitize or escape potentially malicious quote sequences before they reach the parser, although this should be viewed as a compensating control rather than a primary fix given that proper software updates address the root cause directly.