Repository navigation
Update dependency markdown-it to v14 [SECURITY] - #1884
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
added
dependencies
Contributor
Author
|
renovate
Bot
force-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
September 29, 2026 20:51
9565d8e to
12d292f
Compare
renovate
Bot
force-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
October 5, 2026 17:12
12d292f to
be19e4b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
12.3.2→14.3.1markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
CVE-2026-48988 / GHSA-6v5v-wf23-fmfq
More information
Details
Summary
A quadratic time complexity vulnerability exists in markdown-it's smartquotes rule (enabled via the
typographer: trueoption). An attacker can craft a markdown input consisting of consecutive quotation marks that causes the parser to consume excessive CPU time, leading to denial of service.Details
The vulnerability is in the
replaceAt()helper function used by the smartquotes rule inlib/rules_core/smartquotes.mjs:When markdown-it processes a text token containing many quotation marks (either
"or') withtypographer: true, the smartquotes rule iterates through each quote character and callsreplaceAt()to substitute it with a typographic (curly) quote. Each call toreplaceAt()creates three new string slices and concatenates them, which is an O(n) operation where n is the length of the string.Since this is called once per quote character in the token, and there are n quote characters, the total time complexity becomes O(n^2).
The root cause is that the smartquotes rule modifies
token.contentin place using string slicing rather than building the result incrementally. Theprocess_inlines()function (line 14) processes each quote in the text token, and for matching quote pairs, callsreplaceAt()on both the opening and closing token's content (lines 151-152). When the entire input is a single text token of quote characters, this results in quadratic behavior.PoC
Measured timing on a modern system:
The scaling is clearly superlinear (quadratic), with the 80K->160K step showing a ~3.9x increase for a 2x input increase, consistent with O(n^2).
Impact
Applications that render user-supplied markdown with
typographer: trueare vulnerable to denial of service. An attacker can submit a relatively small payload (160KB of quote characters) that causes the server to spend over 21 seconds processing a single request. Repeated submissions can exhaust server CPU resources and prevent legitimate users from being served.The impact is mitigated by the fact that the
typographeroption defaults tofalseand must be explicitly enabled. However, the typographer feature is commonly enabled in production applications that want smart typography, and the markdown-it documentation prominently suggests enabling it.A suggested fix would be to replace the
replaceAt()approach with an array-based or StringBuilder-style approach that collects all replacements and applies them in a single pass, reducing the time complexity to O(n).Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
GHSA-253c-mchw-3w2r
More information
Details
Summary
Two independent quadratic paths in the
linkify: truehandling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads.src/rules_core/linkify.tscallsarrayReplaceAtonce per linkified text token, and that rebuilds the wholechildrenarray each time. A paragraph of N soft-broken lines is one inline token with about 2N children, so you get N rebuilds over a 2N array. Schema-less emails are what reach it. Ahttp://link gets consumed by the inline rule first and never arrives as a text token, so those stay linear.src/rules_inline/linkify.tsrunsstate.pending.match(SCHEME_RE)at every://in the source.state.pendingonly gets truncated once a link is actually produced, so an unregistered scheme leaves it growing and every://rescans the lot.Proof of concept
Clean install of 15.0.0 from npm,
new MarkdownIt({ linkify: true }).render(payload), Node 24.'a@b.co\n'.repeat(N), 34KB to 273KB'a://'.repeat(N), 20KB to 156KBDoubling the input roughly quadruples the time in both. With
linkify: falsethe same inputs run in 25 to 131ms and stay flat.Controls for the first one, all at N=20000: putting every email in a single text token (
'a@b.co ') takes 0.59s, one email per paragraph ('a@b.co\n\n') takes 0.64s, and soft-broken lines with nothing linkifiable take 42ms. So it needs many children AND many of them linkifying. For the second, replaying just theSCHEME_REcalls against the same growing prefixes with no markdown-it involved accounts for 11.7s of the 15s.Ordinary prose does it too.
'ping a@b.co ok\n'.repeat(20000)is 293KB and takes 31s.Caveat
linkifyis off by default, so this only reaches apps that turn it on.Impact
Availability only. A few hundred KB of fairly ordinary markdown pins one core for tens of seconds, and because it's quadratic it degrades quickly with size. Nothing is read, written or executed.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
markdown-it/markdown-it (markdown-it)
v14.3.1Compare Source
v14.3.0Compare Source
Changed
linkify-itto 5.0.2.Fixed
v14.2.0Compare Source
Added
isPunctCharCodeto utilities.Fixed
emphasis-like markers, #1072. Big thanks to @tats-u for his global efforts
with improving CJK support.
;, #1096.lheadingrule, #1131.Security
v14.1.1Compare Source
Security
cause high CPU use. Thanks to @ltduc147 for report.
v14.1.0Compare Source
Changed
Fixed
v14.0.0Compare Source
Changed
.fromCodePointand other features).No signatures changed, except
markdown-it-emojiplugin.dist/folder from repo, build on package publish.punicode.jsas external dependency.Fixed
v13.0.2Compare Source
Security
Fixed
lineorposcounters(previously, markdown-it would likely go into infinite loop instead), #847.
v13.0.1Compare Source
Fixed
linkify-itto 4.0.1. That should fix some hangs, caused by wrongdata, returned from
linkify-it.v13.0.0Compare Source
Added
text_specialto store escaped characters, same astextbutunaffected by replacement plugins (smartquotes, typographer, linkifier, etc.).
text_joinincoreruler. Text replacement plugins may choose toinsert themselves before it.
Changed
(p)is no longer replaced with § by typographer (conflicts with ℗), #763.text_collapserule is renamed tofragments_join.Fixed
with backslash (e.g.
\(c)orgoogle\.comare no longer replaced).http://example.org/foo._bar_-_bazis now a single link, not emphasized). Emails and fuzzy links are not affected by this.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.