CVE-2026-48988: markdown-it Denial-of-Service via Quadratic String Processing

Technical summary

The vulnerability exists in the smartquotes rule of markdown-it's typographer feature, which performs quadratic-time (O(n²)) processing via repeated calls to replaceAt(). Each invocation of replaceAt() requires O(n) string slicing and concatenation operations; applied once per quote character in the input, this produces quadratic behavior. An attacker supplying Markdown with a high density of quotation marks can trigger CPU exhaustion on the parsing server. The issue is classified as CWE-400 (Uncontrolled Resource Consumption), and the fix in version 14.2.0 presumably optimizes the string-manipulation approach to avoid repeated full-string copies.

Business impact

If markdown-it with typographer enabled is deployed in a user-facing application—such as a comment system, note-taking platform, or documentation tool—an unauthenticated attacker can submit Markdown that causes the server to consume excessive CPU. This can degrade performance for legitimate users, trigger auto-scaling events that inflate infrastructure costs, or exhaust resources to the point of service unavailability. Organizations relying on this library for user-supplied content processing face a direct threat to service continuity.

Affected systems

markdown-it versions 14.1.1 and below are affected. The vulnerability is only active when the typographer option is explicitly enabled in the parser configuration. Any application or service integrating markdown-it as a dependency and enabling typographer mode—particularly those processing untrusted user input—is at risk. This includes Node.js applications, serverless functions, and embedded uses of the library.

Exploitability

The vulnerability requires no authentication and no user interaction beyond the ability to submit Markdown for parsing. An attacker can trigger the condition remotely and without special privileges, making exploitability straightforward. However, practical impact depends on whether the target application enables typographer mode and whether it imposes input size or parsing timeout limits. Exploitation does not require complex payload construction; a simple string of quotation marks is sufficient.

Remediation

Upgrade markdown-it to version 14.2.0 or later. If immediate upgrading is not feasible, disable the typographer option in all parser configurations until patching is completed. Additionally, consider implementing input-size limits and parsing timeouts to mitigate resource exhaustion attacks. For applications processing untrusted Markdown, review whether the typographer feature is necessary for your use case; disabling it by default reduces attack surface.

Patch guidance

Update the markdown-it dependency to version 14.2.0 or newer in your package.json or equivalent dependency manifest. After patching, test your Markdown-rendering pipeline—particularly any features that depend on smart typography—to ensure no regressions. If you have custom typographer configurations or extensions, verify compatibility with the patched version. Rollout can typically proceed immediately; the patch is expected to improve performance and carries no breaking changes.

Detection guidance

Monitor for sudden spikes in CPU usage correlating with Markdown parsing operations, particularly if your application accepts user-supplied Markdown. Log and analyze Markdown submissions containing unusual concentrations of quotation marks. If you deploy markdown-it in a containerized environment, set CPU limits and alerts to catch runaway parser processes. Review application logs for parsing timeouts or failures that may indicate exploitation attempts.

Why prioritize this

Although assigned a MEDIUM severity (CVSS 5.3), this vulnerability merits prompt attention if your application accepts user input and enables typographer mode. The attack vector is network-accessible, requires no authentication, and can directly impact service availability. Unlike many vulnerabilities that require chained exploits or privileged access, this one is trivial to trigger. Organizations should prioritize patching based on whether they actually enable typographer mode; if disabled, risk is eliminated entirely.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-accessible, unauthenticated attack with low complexity that impacts availability but not confidentiality or integrity. The score appropriately captures the direct denial-of-service risk. However, context matters: organizations running applications with typographer enabled and accepting untrusted input should treat this as higher priority than the base score suggests, while those with typographer disabled face no risk.

Frequently asked questions