Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-15 | 1 | Disclosure1 |
| 2026-06-17 | 1 | General1 |
CVE-2026-48988 Denial-of-Service Vulnerability in markdown-it 14.1.1 via Smartquotes Processing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48988
Post summary
A denial‑of‑service vulnerability, CVE‑2026‑48988, is highlighted for markdown‑it 14.1.1, but no PoC, exploit, patch, or active exploitation details are offered.
🟠 markdown-it, Denial of Service (DoS), #CVE-2026-48988 (Medium) -DC-Jun2026-456 https://dailycve.com/markdown-it-denial-of-service-dos-cve-2026-48988-medium-dc-jun2026-456/
Post summary
The post announces a new Markdown‑it Denial‑of‑Service vulnerability (CVE‑2026‑48988) with medium severity, but provides no PoC, exploit details, patch information, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | markdown-it_project | markdown-it | - | - | - |