markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes

At a glance

markdown-it: Amber, patch this week. markdown-it has a quadratic-time rendering vulnerability in link reference definitions, allowing an attacker to cause a denial of service (DoS). An attacker could exploit this vulnerability to cause a denial of service.

The flaws

• CVE-2026-111759: Quadratic complexity in smartquotes with unmatched closing quotes (CVSS 7.5 · EPSS 1%)
• CVE-2026-111758: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) (CVSS 7.5 · EPSS 0%)
• GHSA-253c-mchw-3w2r: Markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds (CVSS 6.3)

The fix

Upgrade markdown-it: 14.3.2 · 15.0.2 · 14.3.3 · 15.0.0 · 15.0.3 or later on your release line

Who is exposed: {'products': ['markdown-it'], 'packages': [{'ecosystem': 'npm', 'name': 'markdown-it', 'vulnerable': '>= 14.1.0, < 14.3.3'}, {'ecosystem': 'npm', 'name': 'markdown-it', 'vulnerable': '>= 15.0.0, < 15.0.3'}], 'versions': ['14.1.0 - 14.3.3', '15.0.0 - 15.0.3']}

Where it stands

• Public proof of concept

Connects to

• Same weakness: Denial of service (CWE-400). 255 other warnings in 30 days