Denial of Service Vulnerability in Markdown-It Parser by Markdown-It
CVE-2026-111759
7.5HIGH
What is CVE-2026-111759?
The Markdown-It parser, a widely used Markdown processing tool, contains a vulnerability that allows specially crafted Markdown input to cause significant slowdowns, resulting in denial of service. When the typographic feature is enabled, which many users likely have, the parser can enter a state of prolonged processing caused by uneven matching of quotes, triggering extensive recursive scans. This can occur with a series of opening quotes followed by unmatched closing quotes, or the opposite. To safeguard systems, it is crucial to update to versions 14.3.2 or 15.0.2, which address this issue.
Affected Version(s)
markdown-it >= 15.0.0, < 15.0.2 < 15.0.0, 15.0.2
markdown-it < 14.3.2 < 14.3.2