CVE-2026-111759High· 7.5▾ MidnightPoC availablemarkdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applicat…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. This issue is fixed in versions 14.3.2 and 15.0.2.
markdown-it >= 15.0.0, < 15.0.2markdown-it < 14.3.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111766Low· 3.7markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
GHSA-253c-mchw-3w2rMediummarkdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
CVE-2026-48988Medium· 5.3markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
CVE-2026-100350Medium· 5.3kin-openapi is a Go project for handling OpenAPI files
CVE-2023-32665Medium· 5.5A flaw was found in GLib
CVE-2023-35945High· 7.5Envoy is a cloud-native high-performance edge/middle/service proxy