Denial-of-Service Vulnerability in markdown-it Markdown Parser

CVE-2026-48988

What is CVE-2026-48988?

The markdown-it version 14.1.1 and earlier includes a vulnerability that may lead to denial-of-service (DoS) when the typographer option is enabled. This is caused by the inefficient string processing during the smartquotes handling, where repeated modifications of strings increasingly consume CPU resources. This issue can be particularly impactful for applications that handle markdown content with extensive quotation usage, as it allows attackers to potentially disrupt service availability. It is important to note that although the typographer setting is disabled by default, many production applications enable it for enhanced typography features, making this vulnerability a concern for those environments. An upgrade to version 14.2.0 is recommended to mitigate this risk.

References