CVE-2026-111759: markdown-it DOS Vulnerability

CVE-2026-111759 Overview

CVE-2026-111759 is a denial of service vulnerability in markdown-it, a widely used JavaScript Markdown parser. The flaw resides in the smartquotes rule and is triggered when the typographer: true option is enabled. Specially crafted Markdown input containing many opening double quotes followed by unmatched closing single quotes causes repeated scans of the entire opener stack, producing quadratic processing time [CWE-400]. The reverse pattern (single openers with unmatched double closers) triggers the same behavior. Applications that parse untrusted Markdown with the typographer option enabled can be forced to consume excessive CPU, degrading or halting service. Versions prior to 14.3.2 and 15.0.2 are affected.

Critical Impact

Attackers can submit a short Markdown payload that forces quadratic processing in the smartquotes rule, exhausting CPU resources and denying service to legitimate users.

Affected Products

• markdown-it versions prior to 14.3.2
• markdown-it versions prior to 15.0.2
• Applications parsing untrusted Markdown with typographer: true enabled

Discovery Timeline

• 2026-10-19 - CVE-2026-111759 published to the National Vulnerability Database (NVD)
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-111759

Vulnerability Analysis

The vulnerability is an algorithmic complexity flaw in the smartquotes core rule located at src/rules_core/smartquotes.ts. The rule maintains an opener stack to pair quotation marks and convert them to typographic equivalents. When the parser encounters a closing quote that does not match any opener on the stack, it rescans the entire stack looking for a match. An attacker who supplies many opening double quotes followed by unmatched closing single quotes forces repeated full stack scans, producing processing time proportional to the square of input length. The same degenerate behavior occurs with the quote types reversed. Because the operation runs synchronously in the Node.js event loop, a single malicious document can block all other requests in a server-side rendering context.

Root Cause

The root cause is unbounded stack traversal in the smartquotes matching logic combined with the absence of any cap on the opener stack size. The parser treats each unmatched closer as a trigger to walk every opener still on the stack, so adversarially constructed input turns a linear parse into a quadratic one. The default configuration (typographer: false) does not activate this code path, but many downstream projects enable typographic substitution for rendering quality.

Attack Vector

Exploitation is network-reachable and requires no authentication or user interaction. An attacker submits a Markdown document containing a long run of opening double quotes followed by closing single quotes (or the inverse) to any endpoint that renders Markdown with typographer: true. Common exposure points include comment systems, wiki pages, chat applications, documentation builders, and server-side rendering pipelines.

// Patch excerpt from src/rules_core/smartquotes.ts
const QUOTE_TEST_RE = /['"]/
const QUOTE_RE = /['"]/g
const APOSTROPHE = '\\u2019' /* ’ */
// Caps memory on malicious input
const MAX_OPENERS = 1000

interface Replacement {
  pos: number

Source: GitHub Commit cf27366

The fix introduces a MAX_OPENERS = 1000 cap and a truncateStack helper that drops the oldest openers while restoring the per-quote-type head pointers, bounding worst-case work.

Detection Methods for CVE-2026-111759

Indicators of Compromise

• Sustained CPU saturation of Node.js worker processes handling Markdown rendering requests
• Elongated response times or timeouts on endpoints that accept user-supplied Markdown
• Request bodies containing long contiguous runs of " characters followed by ' characters, or the reverse pattern
• Event loop lag warnings or health-check failures correlated with specific inbound requests

Detection Strategies

• Inventory applications and libraries that depend on markdown-it and record the configured typographer value
• Deploy application-layer rules that flag Markdown payloads exceeding a reasonable count of consecutive quote characters
• Monitor per-request CPU time for Markdown rendering handlers and alert on outliers that exceed baseline by an order of magnitude

Monitoring Recommendations

• Enable event loop lag metrics (for example, perf_hooks monitoring) on Node.js services that render Markdown
• Capture and retain request bodies that trigger CPU anomalies to support post-incident analysis
• Correlate web application firewall (WAF) telemetry with backend latency to identify algorithmic complexity probing

How to Mitigate CVE-2026-111759

Immediate Actions Required

• Upgrade markdown-it to version 14.3.2 or 15.0.2 across all services and transitive dependencies
• Audit configuration for typographer: true and disable it where typographic substitution is not required
• Enforce a maximum input size on endpoints that accept user-supplied Markdown
• Place CPU and timeout limits on Markdown rendering workers to contain resource exhaustion

Patch Information

The maintainers released fixes in markdown-it 14.3.2 and markdown-it 15.0.2. The core change in commit 1b379c1 introduces a QuoteOpener structure with a prevSame pointer that eliminates full stack scans. Commit cf27366 adds a hard MAX_OPENERS = 1000 cap, and commit daf5a3c backports the fix to the 14.x branch. Full details are documented in GHSA-r7fv-28h4-cvq7.

Workarounds

• Set typographer: false when instantiating the parser if typographic conversion is not required
• Reject or truncate Markdown inputs exceeding an operationally reasonable length before parsing
• Run Markdown rendering in a worker thread or isolated process with a strict execution timeout

# Update markdown-it to a patched release
npm install markdown-it@15.0.2
# or for the 14.x branch
npm install markdown-it@14.3.2

# Verify the installed version
npm ls markdown-it