{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amarkdown-it_projectmarkdown-itnode.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:markdown-it_project:markdown-it:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-111759"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["markdown-it (\u003c 14.3.2, \u003c 15.0.2)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe markdown-it library is vulnerable to a regular expression-style denial of service (ReDoS) attack when configured with 'typographer: true'. The vulnerability, identified as CVE-2026-111759, resides in the smartquotes rule implementation. Specifically, the parser performs quadratic processing time when encountering specially crafted sequences of opening and closing single or double quotes. Because this pattern triggers repeated scanning of the entire opener stack, a malicious actor providing malformed Markdown input can cause significant CPU consumption, potentially leading to service degradation or complete denial of service for applications using the parser to render untrusted content. This impact is highest in web applications that process user-submitted Markdown in real-time. The issue is resolved in markdown-it versions 14.3.2 and 15.0.2.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in high CPU utilization on systems parsing malicious Markdown strings. This can lead to service latency, timeouts, or availability loss for applications handling large volumes of user-generated content, such as comment sections, documentation platforms, or messaging services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the markdown-it library to version 14.3.2 or 15.0.2 immediately.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, disable the 'typographer' setting in the markdown-it configuration (typographer: false), as the default configuration is not affected.\u003c/li\u003e\n\u003cli\u003eImplement input validation and length constraints on Markdown strings prior to parsing to mitigate potential resource exhaustion attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T20:12:06Z","date_published":"2026-10-19T20:12:06Z","id":"https://feed.craftedsignal.io/briefs/2026-10-markdown-it-dos/","summary":"A resource exhaustion vulnerability in the markdown-it Markdown parser allows for denial of service (DoS) when processing untrusted input with the typographer option enabled.","title":"Denial of Service Vulnerability in markdown-it Parser","url":"https://feed.craftedsignal.io/briefs/2026-10-markdown-it-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:markdown-It_project:markdown-It:*:*:*:*:*:node.js:*:*","version":"https://jsonfeed.org/version/1.1"}