Markdown-it Denial of Service Flaw in Smartquotes Rule

A high severity denial of service vulnerability exists in the markdown-it Node.js package. The flaw allows attackers to crash applications processing untrusted Markdown content via the smartquotes rule.

What happened

The vulnerability, identified as CVE-2026-111759, affects npm markdown-it versions 15.0.0 through 15.0.1 and versions below 14.3.2. According to the GitHub advisory, the issue arises when the typographer option is set to true. This configuration enables smart typography features, including automatic quote handling.

The smartquotes rule suffers from quadratic processing time when handling specific input patterns. Attackers can craft Markdown containing many opening double quotes followed by unmatched closing single quotes. This forces the parser to repeatedly scan the entire opener stack. Reversing the quote types produces the same excessive processing delay.

The default configuration disables the typographer option, leaving those installations unaffected. However, the advisory notes that this option is enabled with high probability in many deployments. The flaw is fixed in versions 14.3.2 and 15.0.2.

Why it matters

Applications that render user-supplied Markdown with typography enabled are exposed to this denial of service risk. The quadratic nature of the bug means processing time increases dramatically with input size. This can lead to application hangs or service outages.

The widespread use of the default-like configuration suggests many systems may be vulnerable without explicit review. Teams relying on markdown-it for content rendering should verify their configuration settings immediately. The availability of patches reduces the window for exploitation.

Next steps

• Upgrade markdown-it to version 14.3.2 or 15.0.2.
• Disable the typographer option if upgrading is not immediately possible.
• Disable the smartquotes rule specifically to mitigate the risk.
• Audit applications processing untrusted Markdown input.

Detection notes

Teams usually identify this activity through anomalous CPU usage spikes during content rendering. Application logs may show prolonged execution times for the markdown parsing module. Check whether requests containing complex quote patterns cause delays. Monitor for repeated timeout errors in services handling user-generated content. Containment moves involve disabling the vulnerable feature or restricting input complexity. Review deployment configurations to ensure typography is not enabled on public-facing endpoints.

What to do and how to stay safe: markdown-it

• Verify current markdown-it versions in your dependency tree.
• Check if the typographer option is enabled in your configuration.
• Apply the latest patch once the vendor provides an update.
• Monitor server resources for unusual processing delays.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of markdown-it are affected by CVE-2026-111759?

Versions 15.0.0 through 15.0.1 and all versions below 14.3.2 are vulnerable.

Is the default configuration of markdown-it affected?

No, the default configuration with typographer set to false is not affected.

How can teams mitigate this issue before patching?

Teams can disable the typographer option or specifically disable the smartquotes rule.