CVE-2026-111759

Name of the Vulnerable Software and Affected Versions markdown-it versions prior to 14.3.2 markdown-it versions prior to 15.0.2

Description When the typographer option is set to true, specially crafted Markdown input can trigger quadratic processing time within the smartquotes rule. This occurs when a large number of opening double quotes are followed by unmatched closing single quotes, or vice versa, causing repeated scans of the opener stack and potentially leading to a denial of service. The default configuration where typographer is false is not affected.

Recommendations Update to version 14.3.2 or later. Update to version 15.0.2 or later. As a temporary mitigation, set the typographer option to false.