Quadratic time in markdown-it smartquotes causes denial of service
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
markdown-it versions from 15.0.0 before 15.0.2 and versions before 14.3.2 are affected when the typographer option is enabled. Specially crafted Markdown with many unmatched closing quotes makes the smartquotes rule take quadratic processing time (CWE-407). An unauthenticated remote attacker can cause denial of service in applications that process untrusted input. The default configuration with typographer set to false is not affected.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. This issue is fixed in versions 14.3.2 and 15.0.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| markdown-it | markdown-it | 15.0.0 to before 15.0.2; before 14.3.2 | 15.0.2, 14.3.2 | Patch available | CNA |
| — | markdown-it (npm) | 15.0.0 to before 15.0.2 | 15.0.2 | Patch available | GHSA-r7fv-28h4-cvq7 |
| — | markdown-it (npm) | before 14.3.2 | 14.3.2 | Patch available | GHSA-r7fv-28h4-cvq7 |
- markdown-it Vendormarkdown-it Affected 15.0.0 to before 15.0.2; before 14.3.2 Fixed in 15.0.2, 14.3.2 Patch available CNA
- markdown-it (npm) Vendor— Affected 15.0.0 to before 15.0.2 Fixed in 15.0.2 Patch available GHSA-r7fv-28h4-cvq7
- markdown-it (npm) Vendor— Affected before 14.3.2 Fixed in 14.3.2 Patch available GHSA-r7fv-28h4-cvq7
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:markdown-it_project:markdown-it:*:*:*:*:*:*:*:* | — | — | Markdown-it Project |
- cpe:2.3:a:markdown-it_project:markdown-it:*:*:*:*:*:*:*:* Versions — — ·Markdown-it Project
Remediation
Upgrade the npm package markdown-it to 15.0.2 in the 15.x branch and to 14.3.2 in the 14.x branch. Red Hat has no plan to fix markdown-it in Red Hat Build of Podman Desktop, Red Hat Ceph Storage 9, Red Hat Developer Hub 1, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces and Self-service automation portal 2.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA markdown-it (markdown-it) Fixed in 15.0.2, 14.3.2
- Fix · GHSA-r7fv-28h4-cvq7 markdown-it (npm) Fixed in 15.0.2 Advisory →
- Fix · GHSA-r7fv-28h4-cvq7 markdown-it (npm) Fixed in 14.3.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Ceph Storage 9 | Affected | No fix yet |
| Red Hat Developer Hub 1 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Self-service automation portal 2 | Affected | No fix yet |
Not affected: 2 products
- Red Hat Developer Hub 1
- Red Hat Hardened Images
Timeline
- 2026-10-19 Threatist record created from CVE-2026-111759
- 2026-10-20 Affected versions changed · Red Hat
- 2026-10-20 CVSS score added · Red Hat
- 2026-10-20 Alias added: GHSA-r7fv-28h4-cvq7
- 2026-10-20 Fix available: npm/[email protected], npm/[email protected] · GHSA-r7fv-28h4-cvq7
- 2026-10-20 CVSS score added · GHSA-r7fv-28h4-cvq7
- 2026-10-20 Weakness changed · GHSA-r7fv-28h4-cvq7
- 2026-10-20 8 new references · GHSA-r7fv-28h4-cvq7
- 2026-10-21 Affected versions changed · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
References
Other 7
- https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7
- https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670
- https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152
- https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162
- https://github.com/markdown-it/markdown-it/releases/tag/14.3.2
- https://github.com/markdown-it/markdown-it/releases/tag/15.0.2
- https://github.com/markdown-it/markdown-it
More markdown-it vulnerabilities
- TI-2026-36071 linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop CVSS 4.0HIGH 8.7
- TI-2026-78161 Quadratic-time parsing in markdown-it link reference definitions CVSS 3.1HIGH 7.5
- TI-2026-42701 linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text CVSS 3.1HIGH 7.5
- TI-2025-07289 Markdown-it 14.1.0 - Cross-site scripting (XSS) CVSS 4.0MEDIUM 6.9
- TI-2026-36244 markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations CVSS 3.1MEDIUM 5.3
- TI-2022-06047 Uncontrolled Resource Consumption in markdown-it CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-111759 · CVE Program
- CVE-2026-111759 · NVD
- FIRST EPSS
- GHSA-r7fv-28h4-cvq7 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-111759 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences