Node markdown it: markdown-it is a Markdown parser. (CVE-2026-48988)

The markdown-it Markdown parser versions 14.1.1 and earlier contain a denial-of-service vulnerability when the typographer feature is enabled. The vulnerability is caused by the smartquotes rule performing repeated string modifications using replaceAt(), which has O(n) complexity per quote character, resulting in an overall quadratic O(n^2) processing time. This inefficiency can be exploited by attackers supplying quote-heavy markdown input to cause excessive CPU consumption and service disruption. The typographer option is disabled by default but often enabled in production environments for smart typography. The vulnerability is resolved in version 14.2.0.

An attacker can cause a denial-of-service condition by submitting markdown input with many quote characters when typographer is enabled, leading to excessive CPU consumption and potential service disruption. There is no impact on confidentiality or integrity.

Upgrade markdown-it to version 14.2.0 or later, where this denial-of-service vulnerability is fixed. If upgrading is not immediately possible, consider disabling the typographer option to prevent exploitation.