Markdown-it vulnerabilities

Products

• Markdown-it 8
• Linkify-it 2

Newest

• markdown-it markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) CVE-2026-111758 Fix available 7.5 HighOctober 20, 2026
• markdown-it markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled CVE-2026-111766 Fix available 3.7 LowOctober 19, 2026
• markdown-it markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes CVE-2026-111759 Fix available 7.5 HighOctober 19, 2026
• markdown-it linkify-it linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text CVE-2026-59887 Fix available 7.5 HighJuly 8, 2026
• markdown-it linkify-it linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop CVE-2026-48801 Fix available 8.7 HighJune 26, 2026
• markdown-it markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations CVE-2026-48988 Fix available 5.3 MediumJune 15, 2026
• markdown-it markdown-it is has a Regular Expression Denial of Service (ReDoS) CVE-2026-2327 Fix available 6.9 MediumFebruary 12, 2026
• markdown-it Markdown-it 14.1.0 - Cross-site scripting (XSS) CVE-2025-7969 Disputed 6.9 MediumAugust 21, 2025
• markdown-it markdown-it html_re.js redos CVE-2015-10005 Fix available 3.5 LowDecember 27, 2022
• markdown-it Uncontrolled Resource Consumption in markdown-it CVE-2022-21670 Fix available 5.3 MediumJanuary 10, 2022