GHSA-6v5v-wf23-fmfq
Medium · 5.3CVSS
5.3
EPSS
—
Published
Jun 15, 2026
CISA due date
—
The record
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | markdown-it | 0 | 14.2.0 |
Related vulnerabilities
- CVE-2026-48988 markdown-it is a Markdown parser. Same vulnerability
- GHSA-38c4-r59v-3vqw markdown-it is has a Regular Expression Denial of Service (ReDoS) Also affects markdown-it
- CVE-2026-2327 Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to… Also affects markdown-it
- CVE-2026-113795 pypdf is a free and open-source pure-python PDF library. CWE-400
- CVE-2026-83400 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-400
- CVE-2026-112400 Pillow is a Python imaging library. CWE-400
- CVE-2026-111766 markdown-it is a Markdown parser. CWE-400
- CVE-2026-111759 markdown-it is a Markdown parser. CWE-400