{"id":"CVE-2026-48988","aliases":["CLSA-2026-1774225206","CLSA-2026-1787916789","CLSA-2026-1790161417","CLSA-2026-1790598013","CLSA-2026-1790755985","CLSA-2026-1791626468","CLSA-2026-1791629152","CLSA-2026-1791666427","CLSA-2026-1791989508","CLSA-2026-1792369116","CLSA-2026-1792451528","CLSA-2026-1792490021","CLSA-2026-1794058822","CLSA-2026-1794059936","DEBIAN-CVE-2026-48988","EUVD-2026-37799","GHSA-253c-mchw-3w2r","GHSA-6v5v-wf23-fmfq","ROOT-APP-NPM-CVE-2026-48988","UBUNTU-CVE-2026-48988"],"status":"published","title":"markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations","description":"markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00379,"percentile":0.32101,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-407"],"published":"2026-06-15T20:41:06Z","modified":"2026-11-07T19:00:39Z","fixes":[{"ecosystem":"npm","package":"markdown-it","fixed_in":["15.0.1","14.3.1","14.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"markdown-it","fixed_in":["4.3.0-tuxcare.3","4.4.0-tuxcare.2","13.0.2-tuxcare.2","13.0.2-tuxcare.3","4.3.0-tuxcare.4","4.4.0-tuxcare.4","4.0.3-tuxcare.3","8.4.2-tuxcare.2","12.3.2-tuxcare.1","12.3.0-tuxcare.2","14.3.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-markdown-it","fixed_in":["22.2.3+dfsg+~12.2.3-5"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"markdown-it","fixed_in":["14.1.0-aikido.3","14.1.0-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/markdown-it","fixed_in":["14.1.0-root.io.3","14.1.0-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0"},{"last_affected":"15.0.0"},{"fixed":"15.0.1"}]}],"versions":["15.0.0"]},{"source":"ghsa","ecosystem":"npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"14.1.1"},{"fixed":"14.2.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.2-tuxcare.0"},{"fixed":"8.4.2-tuxcare.1"}]}],"versions":["8.4.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0-tuxcare.0"},{"fixed":"4.3.0-tuxcare.3"}]}],"versions":["4.3.0","4.3.0-tuxcare.1","4.3.0-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0-tuxcare.0"},{"fixed":"4.4.0-tuxcare.2"}]}],"versions":["4.4.0","4.4.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.2-tuxcare.0"},{"fixed":"13.0.2-tuxcare.2"}]}],"versions":["13.0.2","13.0.2-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.2-tuxcare.0"},{"fixed":"13.0.2-tuxcare.3"}]}],"versions":["13.0.2","13.0.2-tuxcare.1","13.0.2-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0-tuxcare.0"},{"fixed":"4.3.0-tuxcare.4"}]}],"versions":["4.3.0","4.3.0-tuxcare.1","4.3.0-tuxcare.2","4.3.0-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0-tuxcare.0"},{"fixed":"4.4.0-tuxcare.4"}]}],"versions":["4.4.0","4.4.0-tuxcare.1","4.4.0-tuxcare.2","4.4.0-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.3"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.2-tuxcare.0"},{"fixed":"8.4.2-tuxcare.2"}]}],"versions":["8.4.2","8.4.2-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.3.2-tuxcare.0"},{"fixed":"12.3.2-tuxcare.1"}]}],"versions":["12.3.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.3.0-tuxcare.0"},{"fixed":"12.3.0-tuxcare.2"}]}],"versions":["12.3.0","12.3.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.3.0-tuxcare.0"},{"fixed":"14.3.0-tuxcare.1"}]}],"versions":["14.3.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.0-tuxcare.0"},{"fixed":"14.2.0-tuxcare.1"}]}],"versions":["14.2.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-tuxcare.0"},{"fixed":"10.0.0-tuxcare.1"}]}],"versions":["10.0.0"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-2","22.2.3+dfsg+~12.2.3-3","22.2.3+dfsg+~12.2.3-4","22.2.3+dfsg+~12.2.3-5"]},{"source":"osv","ecosystem":"Debian:13","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-2","22.2.3+dfsg+~12.2.3-3","22.2.3+dfsg+~12.2.3-4","22.2.3+dfsg+~12.2.3-5"]},{"source":"osv","ecosystem":"Debian:14","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.3+dfsg+~12.2.3-5"}]}],"versions":["22.2.3+dfsg+~12.2.3-2","22.2.3+dfsg+~12.2.3-3","22.2.3+dfsg+~12.2.3-4"]},{"source":"osv","ecosystem":"npm","package":"markdown-it","ranges":[{"type":"SEMVER","events":[{"introduced":"15.0.0"},{"fixed":"15.0.1"}]}],"versions":["15.0.0"]},{"source":"osv","ecosystem":"npm","package":"markdown-it","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"14.3.1"}]}]},{"source":"osv","ecosystem":"npm","package":"markdown-it","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"14.2.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.0-aikido.3"},{"fixed":"14.1.0-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.0-root.io.3"},{"fixed":"14.1.0-root.io.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0+dfsg-2","10.0.0+dfsg-3","10.0.0+dfsg-3.1","10.0.0+dfsg-4","10.0.0+dfsg-5","10.0.0+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-4","22.2.3+dfsg+~12.2.3-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-2","22.2.3+dfsg+~12.2.3-4"]}],"products":[{"vendor":"markdown-it","product":"markdown-it"},{"vendor":"markdown-it_project","product":"markdown-it"}],"references":[{"url":"https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/markdown-it/markdown-it/commit/9ce2087562c45d1e5ddd9f76b990f4b3fbe040e5","tags":["x_refsource_MISC","Patch","fix","report"]},{"url":"https://github.com/markdown-it/markdown-it/security/advisories/GHSA-253c-mchw-3w2r","tags":["web"]},{"url":"https://github.com/markdown-it/markdown-it/commit/09fa07118dda4c953f058848f53dae88395618ca","tags":["web"]},{"url":"https://github.com/markdown-it/markdown-it/commit/aaadcfa6d817b3c5f89afb49d97c7b797a6dd4fd","tags":["web"]},{"url":"https://github.com/markdown-it/markdown-it/commit/ad70f6b7cff64bee10e42a774147112480ca0d49","tags":["web"]},{"url":"https://github.com/advisories/GHSA-253c-mchw-3w2r"},{"url":"https://github.com/advisories/GHSA-6v5v-wf23-fmfq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48988.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48988","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-48988","tags":["advisory"]},{"url":"https://github.com/markdown-it/markdown-it","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-48988","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48988","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-48988","title":"markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations","description":"markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.","status":"published","published":"2026-06-17T20:54:06.641Z","modified":"2026-06-18T19:41:43.861Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:19:47.998488Z"}],"euvd":[{"id":"EUVD-2026-37799","description":"markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.","status":"published","published":"2026-06-17T20:54:06Z","modified":"2026-06-18T19:41:43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:36.276608Z"}],"ghsa":[{"id":"GHSA-253c-mchw-3w2r","title":"markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds","description":"## Summary\n\nTwo independent quadratic paths in the `linkify: true` handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads.\n\n`src/rules_core/linkify.ts` calls `arrayReplaceAt` once per linkified text token, and that rebuilds the whole `children` array each time. A paragraph of N soft-broken lines is one inline token with about 2N children, so you get N rebuilds over a 2N array. Schema-less emails are what reach it. A `http://` link gets consumed by the inline rule first and never arrives as a text token, so those stay linear.\n\n`src/rules_inline/linkify.ts` runs `state.pending.match(SCHEME_RE)` at every `://` in the source. `state.pending` only gets truncated once a link is actually produced, so an unregistered scheme leaves it growing and every `://` rescans the lot.\n\n## Proof of concept\n\nClean install of 15.0.0 from npm, `new MarkdownIt({ linkify: true }).render(payload)`, Node 24.\n\n| N | 5,000 | 10,000 | 20,000 | 40,000 |\n|---|---|---|---|---|\n| `'a@b.co\\n'.repeat(N)`, 34KB to 273KB | 1.1s | 4.7s | 19.6s | 89s |\n| `'a://'.repeat(N)`, 20KB to 156KB | 0.25s | 0.76s | 3.1s | 15.0s |\n\nDoubling the input roughly quadruples the time in both. With `linkify: false` the same inputs run in 25 to 131ms and stay flat.\n\nControls for the first one, all at N=20000: putting every email in a single text token (`'a@b.co '`) takes 0.59s, one email per paragraph (`'a@b.co\\n\\n'`) takes 0.64s, and soft-broken lines with nothing linkifiable take 42ms. So it needs many children AND many of them linkifying. For the second, replaying just the `SCHEME_RE` calls against the same growing prefixes with no markdown-it involved accounts for 11.7s of the 15s.\n\nOrdinary prose does it too. `'ping a@b.co ok\\n'.repeat(20000)` is 293KB and takes 31s.\n\n## Caveat\n\n`linkify` is off by default, so this only reaches apps that turn it on.\n\n## Impact\n\nAvailability only. A few hundred KB of fairly ordinary markdown pins one core for tens of seconds, and because it's quadratic it degrades quickly with size. Nothing is read, written or executed.","status":"published","published":"2026-09-29T17:57:56Z","modified":"2026-11-02T18:55:26Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T19:02:37.608119Z"},{"id":"GHSA-6v5v-wf23-fmfq","title":"markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations","description":"### Summary\n\nA quadratic time complexity vulnerability exists in markdown-it's smartquotes rule (enabled via the `typographer: true` option). An attacker can craft a markdown input consisting of consecutive quotation marks that causes the parser to consume excessive CPU time, leading to denial of service.\n\n### Details\n\nThe vulnerability is in the `replaceAt()` helper function used by the smartquotes rule in `lib/rules_core/smartquotes.mjs`:\n\n```javascript\nfunction replaceAt (str, index, ch) {\n  return str.slice(0, index) + ch + str.slice(index + 1)\n}\n```\n\nWhen markdown-it processes a text token containing many quotation marks (either `\"` or `'`) with `typographer: true`, the smartquotes rule iterates through each quote character and calls `replaceAt()` to substitute it with a typographic (curly) quote. Each call to `replaceAt()` creates three new string slices and concatenates them, which is an O(n) operation where n is the length of the string.\n\nSince this is called once per quote character in the token, and there are n quote characters, the total time complexity becomes O(n^2).\n\nThe root cause is that the smartquotes rule modifies `token.content` in place using string slicing rather than building the result incrementally. The `process_inlines()` function (line 14) processes each quote in the text token, and for matching quote pairs, calls `replaceAt()` on both the opening and closing token's content (lines 151-152). When the entire input is a single text token of quote characters, this results in quadratic behavior.\n\n### PoC\n\n```javascript\nconst md = require('markdown-it');\nconst instance = md({ typographer: true });\n\n// 160,000 consecutive double-quote characters\nconst payload = '\"'.repeat(160000);\n\nconsole.time('render');\ninstance.render(payload);\nconsole.timeEnd('render');\n// Output: render: ~21000ms (21 seconds)\n\n// Compare with typographer disabled:\nconst safe = md({ typographer: false });\nconsole.time('render-safe');\nsafe.render(payload);\nconsole.timeEnd('render-safe');\n// Output: render-safe: ~8ms\n```\n\nMeasured timing on a modern system:\n- 10,000 quotes: ~19ms\n- 20,000 quotes: ~51ms\n- 40,000 quotes: ~212ms\n- 80,000 quotes: ~5,430ms\n- 160,000 quotes: ~21,198ms\n\nThe scaling is clearly superlinear (quadratic), with the 80K-\u003e160K step showing a ~3.9x increase for a 2x input increase, consistent with O(n^2).\n\n### Impact\n\nApplications that render user-supplied markdown with `typographer: true` are vulnerable to denial of service. An attacker can submit a relatively small payload (160KB of quote characters) that causes the server to spend over 21 seconds processing a single request. Repeated submissions can exhaust server CPU resources and prevent legitimate users from being served.\n\nThe impact is mitigated by the fact that the `typographer` option defaults to `false` and must be explicitly enabled. However, the typographer feature is commonly enabled in production applications that want smart typography, and the markdown-it documentation prominently suggests enabling it.\n\nA suggested fix would be to replace the `replaceAt()` approach with an array-based or StringBuilder-style approach that collects all replacements and applies them in a single pass, reducing the time complexity to O(n).","status":"published","published":"2026-06-15T20:41:06Z","modified":"2026-06-15T20:41:07Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:40:28.438722Z"}],"nvd":[{"id":"CVE-2026-48988","description":"markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.","status":"published","published":"2026-06-17T21:16:23.563Z","modified":"2026-06-24T19:06:21.497Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:24.544761Z"}],"osv":[{"id":"CVE-2026-48988","title":"markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations","description":"markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.","status":"published","published":"2026-06-17T20:54:06.641Z","modified":"2026-10-28T02:30:36.304447051Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"DEBIAN-CVE-2026-48988","description":"markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.","status":"published","published":"2026-06-17T21:16:23.563Z","modified":"2026-10-01T03:03:08.212017342Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"GHSA-253c-mchw-3w2r","title":"markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds","description":"## Summary\n\nTwo independent quadratic paths in the `linkify: true` handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads.\n\n`src/rules_core/linkify.ts` calls `arrayReplaceAt` once per linkified text token, and that rebuilds the whole `children` array each time. A paragraph of N soft-broken lines is one inline token with about 2N children, so you get N rebuilds over a 2N array. Schema-less emails are what reach it. A `http://` link gets consumed by the inline rule first and never arrives as a text token, so those stay linear.\n\n`src/rules_inline/linkify.ts` runs `state.pending.match(SCHEME_RE)` at every `://` in the source. `state.pending` only gets truncated once a link is actually produced, so an unregistered scheme leaves it growing and every `://` rescans the lot.\n\n## Proof of concept\n\nClean install of 15.0.0 from npm, `new MarkdownIt({ linkify: true }).render(payload)`, Node 24.\n\n| N | 5,000 | 10,000 | 20,000 | 40,000 |\n|---|---|---|---|---|\n| `'a@b.co\\n'.repeat(N)`, 34KB to 273KB | 1.1s | 4.7s | 19.6s | 89s |\n| `'a://'.repeat(N)`, 20KB to 156KB | 0.25s | 0.76s | 3.1s | 15.0s |\n\nDoubling the input roughly quadruples the time in both. With `linkify: false` the same inputs run in 25 to 131ms and stay flat.\n\nControls for the first one, all at N=20000: putting every email in a single text token (`'a@b.co '`) takes 0.59s, one email per paragraph (`'a@b.co\\n\\n'`) takes 0.64s, and soft-broken lines with nothing linkifiable take 42ms. So it needs many children AND many of them linkifying. For the second, replaying just the `SCHEME_RE` calls against the same growing prefixes with no markdown-it involved accounts for 11.7s of the 15s.\n\nOrdinary prose does it too. `'ping a@b.co ok\\n'.repeat(20000)` is 293KB and takes 31s.\n\n## Caveat\n\n`linkify` is off by default, so this only reaches apps that turn it on.\n\n## Impact\n\nAvailability only. A few hundred KB of fairly ordinary markdown pins one core for tens of seconds, and because it's quadratic it degrades quickly with size. Nothing is read, written or executed.","status":"published","published":"2026-09-29T17:57:56Z","modified":"2026-09-29T18:15:04.692324591Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"GHSA-6v5v-wf23-fmfq","title":"markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations","description":"### Summary\n\nA quadratic time complexity vulnerability exists in markdown-it's smartquotes rule (enabled via the `typographer: true` option). An attacker can craft a markdown input consisting of consecutive quotation marks that causes the parser to consume excessive CPU time, leading to denial of service.\n\n### Details\n\nThe vulnerability is in the `replaceAt()` helper function used by the smartquotes rule in `lib/rules_core/smartquotes.mjs`:\n\n```javascript\nfunction replaceAt (str, index, ch) {\n  return str.slice(0, index) + ch + str.slice(index + 1)\n}\n```\n\nWhen markdown-it processes a text token containing many quotation marks (either `\"` or `'`) with `typographer: true`, the smartquotes rule iterates through each quote character and calls `replaceAt()` to substitute it with a typographic (curly) quote. Each call to `replaceAt()` creates three new string slices and concatenates them, which is an O(n) operation where n is the length of the string.\n\nSince this is called once per quote character in the token, and there are n quote characters, the total time complexity becomes O(n^2).\n\nThe root cause is that the smartquotes rule modifies `token.content` in place using string slicing rather than building the result incrementally. The `process_inlines()` function (line 14) processes each quote in the text token, and for matching quote pairs, calls `replaceAt()` on both the opening and closing token's content (lines 151-152). When the entire input is a single text token of quote characters, this results in quadratic behavior.\n\n### PoC\n\n```javascript\nconst md = require('markdown-it');\nconst instance = md({ typographer: true });\n\n// 160,000 consecutive double-quote characters\nconst payload = '\"'.repeat(160000);\n\nconsole.time('render');\ninstance.render(payload);\nconsole.timeEnd('render');\n// Output: render: ~21000ms (21 seconds)\n\n// Compare with typographer disabled:\nconst safe = md({ typographer: false });\nconsole.time('render-safe');\nsafe.render(payload);\nconsole.timeEnd('render-safe');\n// Output: render-safe: ~8ms\n```\n\nMeasured timing on a modern system:\n- 10,000 quotes: ~19ms\n- 20,000 quotes: ~51ms\n- 40,000 quotes: ~212ms\n- 80,000 quotes: ~5,430ms\n- 160,000 quotes: ~21,198ms\n\nThe scaling is clearly superlinear (quadratic), with the 80K-\u003e160K step showing a ~3.9x increase for a 2x input increase, consistent with O(n^2).\n\n### Impact\n\nApplications that render user-supplied markdown with `typographer: true` are vulnerable to denial of service. An attacker can submit a relatively small payload (160KB of quote characters) that causes the server to spend over 21 seconds processing a single request. Repeated submissions can exhaust server CPU resources and prevent legitimate users from being served.\n\nThe impact is mitigated by the fact that the `typographer` option defaults to `false` and must be explicitly enabled. However, the typographer feature is commonly enabled in production applications that want smart typography, and the markdown-it documentation prominently suggests enabling it.\n\nA suggested fix would be to replace the `replaceAt()` approach with an array-based or StringBuilder-style approach that collects all replacements and applies them in a single pass, reducing the time complexity to O(n).","status":"published","published":"2026-06-15T20:41:06Z","modified":"2026-09-10T03:51:08.074107342Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"UBUNTU-CVE-2026-48988","description":"markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.","status":"published","published":"2026-06-17T21:16:00Z","modified":"2026-10-17T13:00:23.956565532Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"CLSA-2026-1774225206","title":"TuxCare security update for markdown-it (2 CVEs)","description":"TuxCare rebuilt markdown-it to address 2 CVEs. Fixed in 8.4.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:01.489723869Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1787916789","title":"TuxCare security update for markdown-it (1 CVE)","description":"TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.3.0-tuxcare.3.","status":"published","published":"2026-08-28T11:33:09Z","modified":"2026-10-15T09:48:03.154058695Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790161417","title":"TuxCare security update for markdown-it (1 CVE)","description":"TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.4.0-tuxcare.2.","status":"published","published":"2026-09-23T11:03:37Z","modified":"2026-10-15T09:46:03.007462458Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790598013","title":"TuxCare security update for markdown-it (1 CVE)","description":"TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 13.0.2-tuxcare.2.","status":"published","published":"2026-09-28T12:20:13Z","modified":"2026-10-15T09:48:03.135303034Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790755985","title":"TuxCare security update for markdown-it (1 CVE)","description":"TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 13.0.2-tuxcare.3.","status":"published","published":"2026-09-30T08:13:05Z","modified":"2026-10-15T09:47:53.549626022Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791626468","title":"TuxCare security update for markdown-it (1 CVE)","description":"TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.3.0-tuxcare.4.","status":"published","published":"2026-10-10T10:01:08Z","modified":"2026-10-15T09:48:04.600726547Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791629152","title":"TuxCare security update for markdown-it (1 CVE)","description":"TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.4.0-tuxcare.4.","status":"published","published":"2026-10-10T10:45:52Z","modified":"2026-10-15T09:48:00.143864873Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791666427","title":"TuxCare security update for markdown-it (1 CVE)","description":"TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.0.3-tuxcare.3.","status":"published","published":"2026-10-10T21:07:07Z","modified":"2026-10-15T09:46:03.510306009Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791989508","title":"TuxCare security update for markdown-it (1 CVE)","description":"TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 8.4.2-tuxcare.2.","status":"published","published":"2026-10-14T14:51:48Z","modified":"2026-10-15T09:47:21.174617346Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792369116","title":"TuxCare security update for markdown-it (2 CVEs)","description":"TuxCare rebuilt markdown-it to address 2 CVEs. Fixed in 12.3.2-tuxcare.1.","status":"published","published":"2026-10-19T00:18:36Z","modified":"2026-10-19T07:47:03.515172955Z","updated_at":"2026-11-02T15:43:53.353888Z"},{"id":"CLSA-2026-1792451528","title":"TuxCare security update for markdown-it (2 CVEs)","description":"TuxCare rebuilt markdown-it to address 2 CVEs. Fixed in 12.3.0-tuxcare.2.","status":"published","published":"2026-10-19T23:12:08Z","modified":"2026-10-20T01:45:10.54700098Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792490021","title":"TuxCare security update for markdown-it (1 CVE)","description":"TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 14.3.0-tuxcare.1.","status":"published","published":"2026-10-20T09:53:41Z","modified":"2026-10-20T13:45:13.463355257Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1794058822","title":"TuxCare security update for markdown-it (4 CVEs)","description":"TuxCare rebuilt markdown-it to address 4 CVEs. Fixed in 14.2.0-tuxcare.1.","status":"published","published":"2026-11-07T14:40:23Z","modified":"2026-11-07T19:00:36.655919382Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1794059936","title":"TuxCare security update for markdown-it (5 CVEs)","description":"TuxCare rebuilt markdown-it to address 5 CVEs. Fixed in 10.0.0-tuxcare.1.","status":"published","published":"2026-11-07T14:58:57Z","modified":"2026-11-07T19:00:39.606191823Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"ROOT-APP-NPM-CVE-2026-48988","title":"CVE-2026-48988 in markdown-it - Patched by Root","description":"Root has patched CVE-2026-48988 in the markdown-it package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-26T07:30:13Z","modified":"2026-10-26T08:15:02.99983344Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}