CVE-2026-48988

What it actually does

CVE-2026-48988 is an algorithmic complexity denial-of-service flaw in markdown-it versions 14.1.1 and earlier when the `typographer: true` option is enabled. The vulnerable smartquotes rule repeatedly modifies strings using `replaceAt()`, causing O(n²) processing behavior for quote-heavy Markdown input. A remote unauthenticated attacker who can submit Markdown for parsing can provide specially crafted content that drives excessive CPU consumption during rendering. The impact is availability only; the flaw does not directly enable code execution, data theft, or data modification.

Why it matters to the business

Applications that accept user-supplied Markdown and render it with markdown-it typographer mode enabled may experience slowdowns, worker exhaustion, request timeouts, or service disruption. This is most relevant for comment systems, documentation platforms, forums, CMS features, issue trackers, chat/collaboration tools, and any service that renders untrusted Markdown. The CVSS score is moderate and EPSS is currently low, and it is not listed in CISA KEV, but the low attack complexity and unauthenticated network attack surface make it important for internet-facing services that parse Markdown at request time.

How an attack unfolds

An attacker first identifies an application endpoint that accepts Markdown and returns rendered content, previews, comments, posts, tickets, documentation pages, or messages. If the application uses markdown-it 14.1.1 or earlier with `typographer: true`, the attacker submits Markdown containing a very large number of quote characters arranged to trigger the smartquotes rule. During parsing, markdown-it repeatedly performs string slicing and concatenation for each quote replacement, causing processing time to grow quadratically as input size increases. By sending one or more such requests, the attacker can consume CPU on application workers, increase latency for legitimate users, trigger timeouts, and potentially exhaust autoscaling or queue capacity. No authentication is required if the vulnerable Markdown-rendering endpoint is public; where Markdown submission requires an account, a low-privileged user may still be able to exploit the issue.

How to fix it

Upgrade markdown-it to version 14.2.0 or later. If immediate upgrade is not possible, disable typographer mode by setting `typographer: false`, especially for untrusted user-supplied Markdown. Add input size limits for Markdown fields, request body limits, rendering timeouts, and per-user or per-IP rate limits. Consider asynchronous rendering with resource isolation for untrusted content so expensive parsing cannot block critical request-handling workers. Cache rendered Markdown where appropriate, but ensure malicious content cannot be repeatedly re-rendered. Review transitive dependencies and bundled frontend/backend packages that include markdown-it, since applications may not depend on it directly.

How to confirm the fix worked

Confirm that the resolved markdown-it version is 14.2.0 or later in package manifests and lockfiles, such as `package.json`, `package-lock.json`, `yarn.lock`, or `pnpm-lock.yaml`. Run dependency inventory commands such as `npm ls markdown-it`, `yarn why markdown-it`, or `pnpm why markdown-it` to identify direct and transitive uses. Verify application configuration to determine whether `typographer: true` is enabled. In a controlled non-production environment, test quote-heavy Markdown input before and after the fix and confirm parsing time no longer grows disproportionately with input size. Validate that Markdown input length limits, request timeouts, and rate limits are enforced at the application or gateway layer.

Typical attack path

1. Find a web application feature that accepts Markdown input, such as comments, posts, issue descriptions, documentation pages, previews, or messages.
2. Submit test Markdown containing quote-heavy input and observe whether rendering latency increases abnormally.
3. Craft a larger payload with many single or double quote characters to trigger expensive smartquotes processing when `typographer: true` is enabled.
4. Send repeated or concurrent requests containing the malicious Markdown payload.
5. Consume CPU in the Markdown parsing process, causing degraded response times, request timeouts, worker saturation, or temporary service unavailability.

How to detect it

Review web access logs, application logs, WAF logs, API gateway logs, APM traces, and CPU metrics for signs of large or repeated Markdown submissions that correlate with high CPU usage, elevated render latency, 5xx responses, 408/499/504 timeouts, or worker restarts. Focus on endpoints that create or preview Markdown content, such as comments, posts, messages, issue descriptions, documentation pages, and preview APIs. Look for request bodies or captured payload samples containing unusually dense single or double quote characters. In application telemetry, search for slow spans or functions associated with Markdown rendering, markdown-it parsing, or smartquotes/typographer processing. Because this flaw is a denial-of-service issue, exploitation may leave limited durable forensic artifacts beyond logs showing large quote-heavy inputs, latency spikes, CPU saturation, and repeated requests from the same client, account, IP address, ASN, or automation pattern.

• markdown-it
• typographer: true
• smartquotes
• replaceAt
• ''''''''''''''''''''''''''''''''
• \"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"
• POST /preview
• POST /markdown
• POST /render
• POST /comments
• POST /posts
• POST /issues
• POST /messages
• POST /api/preview
• POST /api/markdown
• POST /api/render
• 504 Gateway Timeout
• request timeout
• CPU limit exceeded
• JavaScript heap out of memory
• Event loop blocked

What your security team should do

• Inventory all services, repositories, and container images using markdown-it and prioritize internet-facing or user-generated-content applications.
• Upgrade markdown-it to 14.2.0 or later wherever present, including transitive dependency paths where feasible.
• Disable `typographer: true` for untrusted Markdown if the upgrade cannot be deployed immediately.
• Apply request body limits, Markdown field length limits, rate limiting, and rendering timeouts to reduce denial-of-service risk.
• Review application performance telemetry for abnormal CPU spikes or request latency on Markdown rendering endpoints since publication.
• Add monitoring for repeated large Markdown submissions containing unusually high counts of quote characters.
• Ensure incident response runbooks include temporary mitigation options such as disabling Markdown preview/rendering, disabling typographer mode, or blocking abusive sources.