markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
Impact
When typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input.
Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed.
The default configuration (typographer: false) is not affected, but this option is enabled with high probability.
Reproduction
import MarkdownIt from 'markdown-it'
import { performance } from 'node:perf_hooks'
const md = new MarkdownIt({ typographer: true })
for (const k of [2000, 4000, 8000, 16000, 32000]) {
const input = '"a '.repeat(k) + "b' ".repeat(k)
const start = performance.now()
md.render(input)
console.log(input.length, (performance.now() - start).toFixed(1), 'ms')
}Result:
| input size | time |
|---|---|
| 12000 | 18ms |
| 24000 | 47ms |
| 48000 | 115ms |
| 96000 | 428ms |
| 192000 | 1586ms |
Patches
Fixed in 15.0.2 and 14.3.2.
Workarounds
Disable typography with typographer: false, or disable only the smartquotes rule:
md.disable('smartquotes')What to do
Upgrade to 15.0.2, 14.3.2, or later. If upgrading is not immediately possible, apply the workaround by disabling typography with typographer: false or disabling only the smartquotes rule.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | markdown-it | >= 15.0.0, < 15.0.2, < 14.3.2 | 15.0.2, 14.3.2 |
References
- https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7
- https://nvd.nist.gov/vuln/detail/CVE-2026-111759
- https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670
- https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152
- https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162
- https://github.com/markdown-it/markdown-it
- https://github.com/markdown-it/markdown-it/releases/tag/14.3.2
- https://github.com/markdown-it/markdown-it/releases/tag/15.0.2
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-400, CWE-407- Platform
- npm
- Package
markdown-it- Disclosed
- 20.10.2026
- Updated
- 20.10.2026 18:18
Sources and licenses · Edited or translated by DockRay; source rights and applicable licenses are retained.
OSV / GitHub Advisory Database - GHSA-r7fv-28h4-cvq7 - CC BY 4.0
Vulnerability history: markdown-it
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 8
- First → latest
- 01.2022 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 3
- Medium 4
- Low 1
Disclosures per year
- 2022: 2
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 6
-
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.