CVE-2026-53429

Name of the Vulnerable Software and Affected Versions mdex versions 0.11.0 through 0.12.2 mdex native versions 0.1.0 through 0.2.2

Description A memory leak occurs in the native rendering code when processing documents containing escaped-tag nodes. The conversion of each %MDEx.EscapedTag{} node into its native representation via the Rust NIF (Native Implemented Function) uses Box::leak on the caller-supplied literal string. This causes the memory allocation to persist for the entire lifetime of the operating system process without being freed. Since the number of nodes and the length of the literals are attacker-controlled and lack size caps or rate limits, repeated rendering of such documents leads to unbounded native memory exhaustion. This can be triggered through the MDEx.to html/1 endpoint or any API that renders a %MDEx.Document{}. Consequently, an attacker can cause a denial of service by exhausting the resident memory of the BEAM process, leading to a system crash.

Recommendations Update mdex to version 0.12.3 or later. Update mdex native to version 0.2.3 or later.