CVE-2026-111759

Name	CVE-2026-111759
Description	markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. This issue is fixed in versions 14.3.2 and 15.0.2.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-markdown-it (PTS)	bookworm, trixie	22.2.3+dfsg+~12.2.3-2	vulnerable
	forky, sid	22.2.3+dfsg+~12.2.3-5	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-markdown-it	source	(unstable)	(unfixed)

Notes

https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7
Fixed by: https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670 (15.0.2)
Followup: https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152 (15.0.2)
Fixed by: https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162 (14.3.2)