CVE-2026-53428

Name of the Vulnerable Software and Affected Versions mdex versions 0.11.0 through 0.12.2 mdex native versions 0.1.0 through 0.2.2

Description An unauthenticated attacker can cause a denial of service through unbounded memory allocation. The issue occurs when the parse highlight lines() function in the native adapter eagerly expands a user-controlled inclusive line range from a fenced code block's highlight lines decorator into a Vec<usize> without an upper bound on the range size. An attacker providing Markdown rendered via MDEx.to html/2 can specify an extremely large range, forcing the system to allocate excessive memory and abort the BEAM, which denies service to all users of the rendering process. Additionally, the per-line write loop performs a linear scan over the vector, resulting in quadratic cost for rendering. Exploitation requires the application to enable code-block decorators by setting both github pre lang and full info string render options and configuring an inline syntax-highlight formatter.

Recommendations Update mdex to version 0.12.3 or later. Update mdex native to version 0.2.3 or later. As a temporary workaround, disable code-block decorators by leaving the github pre lang and full info string render options unset or avoid configuring an inline syntax-highlight formatter to prevent the parsing of highlight lines specifications.