CVE-2026-53429: mdex/mdex_native Memory Leak DOS Vulnerability

CVE-2026-53429 Overview

CVE-2026-53429 is a memory leak vulnerability [CWE-401] in the mdex and mdex_native Elixir packages by leandrocp. The flaw resides in the native Rust NIF (native/mdex_native_nif/src/types/document.rs), where the From<ExEscapedTag> for NodeValue implementation calls Box::leak on caller-supplied literal strings. Every render of a document containing escaped-tag nodes permanently leaks literal_size x node_count bytes for the lifetime of the BEAM process. An attacker who controls rendered documents can drive resident memory upward without limit, ultimately crashing the node.

Critical Impact
Attacker-controlled Markdown documents can exhaust native memory on the BEAM VM, crashing every process on the node and causing a denial of service.

Affected Products

mdex from 0.11.0 before 0.12.3
mdex_native from 0.1.0 before 0.2.3
Any Elixir application invoking MDEx.to_html/1 or rendering a %MDEx.Document{} derived from user input

Discovery Timeline

2026-06-29 - CVE-2026-53429 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-53429

Vulnerability Analysis

The vulnerability stems from unsafe memory management in the Rust Native Implemented Function (NIF) that backs the Elixir mdex Markdown rendering library. When converting an %MDEx.EscapedTag{} node into its native NodeValue::EscapedTag representation, the code invokes Box::leak on the caller-supplied literal string. This intentionally surrenders ownership of the heap allocation to obtain a &'static str, meaning the memory is never freed until the operating system process terminates.

Because both the byte length of each literal and the number of escaped-tag nodes are attacker-controlled, and no size cap, rate limit, or string interning exists on this path, each render leaks unbounded native memory. Repeated renders accumulate leaked allocations until the BEAM node exhausts memory and crashes.

Root Cause

The root cause is misuse of Box::leak as a lifetime-extension mechanism on untrusted input. Box::leak is designed for compile-time-known static data, not runtime-derived attacker input. The fix restricts leakable literals to a fixed allowlist of known escaped-tag markers (|, ~, ~~, ==, ++) and falls back to owned Text nodes for anything else.

Attack Vector

An attacker submits Markdown content containing many escaped-tag nodes with large literal payloads through any application endpoint that calls MDEx.to_html/1 or renders a %MDEx.Document{}. Each request leaks memory permanently. Sustained requests progressively exhaust the node's resident memory.

rust

// Security patch: native/mdex_native_nif/src/types/document.rs
impl From<ExEscapedTag> for NodeValue {
    fn from(node: ExEscapedTag) -> Self {
-        NodeValue::EscapedTag(Box::leak(node.literal.into_boxed_str()))
+        if let Some(literal) = comrak_escaped_tag_literal(&node.literal) {
+            NodeValue::EscapedTag(literal)
+        } else {
+            NodeValue::Text(node.literal.into())
+        }
+    }
+}
+
+fn comrak_escaped_tag_literal(literal: &str) -> Option<&'static str> {
+    match literal {
+        "|" => Some("|"),
+        "~" => Some("~"),
+        "~~" => Some("~~"),
+        "==" => Some("=="),
+        "++" => Some("++"),
+        _ => None,
+    }
+}

Source: GitHub Commit cbd927f

Detection Methods for CVE-2026-53429

Indicators of Compromise

Steadily increasing resident set size (RSS) of the BEAM VM process without correlating growth in Erlang-tracked memory counters
OOM-killer terminations of the BEAM node following bursts of Markdown rendering traffic
Elevated request volume to endpoints that parse user-supplied Markdown containing repeated escaped-tag sequences

Detection Strategies

Compare erlang:memory/0 totals against operating system RSS for the BEAM process; a widening gap indicates native leak activity
Audit dependency manifests (mix.exs, mix.lock) for mdex versions between 0.11.0 and 0.12.2 or mdex_native between 0.1.0 and 0.2.2
Inspect application logs and reverse proxy logs for high-frequency Markdown submissions containing dense escaped-tag markers

Monitoring Recommendations

Instrument long-term memory trend dashboards for BEAM nodes rendering user-supplied content
Alert on sustained RSS growth exceeding a defined threshold over rolling time windows
Track request-rate and payload-size metrics for endpoints invoking MDEx.to_html/1

How to Mitigate CVE-2026-53429

Immediate Actions Required

Upgrade mdex to 0.12.3 or later
Upgrade mdex_native to 0.2.3 or later
Restart affected BEAM nodes to reclaim leaked memory after upgrading
Apply rate limiting and payload size caps on endpoints that render user-supplied Markdown

Patch Information

The fix landed in commit cbd927f on mdex_native, replacing the unbounded Box::leak with an allowlist function comrak_escaped_tag_literal that returns &'static str only for a fixed set of known markers. Non-matching literals fall through to owned NodeValue::Text values, which are freed normally. See the GitHub Security Advisory GHSA-cmvp-gp9f-23xw and the CNA Security Advisory for full details.

Workarounds

Reject or sanitize Markdown input containing escaped-tag nodes before invoking MDEx.to_html/1
Isolate rendering workloads in short-lived worker nodes that are periodically restarted to bound cumulative leakage
Enforce strict input length limits on user-submitted Markdown until patched versions are deployed

bash

# Upgrade to patched versions via Mix
mix deps.update mdex mdex_native

# Verify installed versions meet minimums
mix deps | grep -E "mdex |mdex_native"
# Expected: mdex >= 0.12.3, mdex_native >= 0.2.3