CVE-2026-111759

7.5High

Published 19 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-400, CWE-407

Impact

Remote unauthenticated attackers can cause a denial of service by hanging the Node.js event loop with crafted Markdown. They only need to submit input to an endpoint using the parser with typographer enabled.

Root cause

The smartquotes rule performs repeated full-stack scans on unmatched quotes, causing quadratic processing time.

Affected systems

markdown-it versions prior to 14.3.2 and 15.0.0 through 15.0.1 (with typographer: true)

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade markdown-it to 14.3.2 or 15.0.2. If patching immediately is not possible, disable the setting by setting { typographer: false } in the parser configuration.

shell

$ npm install markdown-it@latest

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. This issue is fixed in versions 14.3.2 and 15.0.2.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111759