markdown-it vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20251
3. 20266

Newest CVEs

• CVE-2026-111758

  markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

  markdown-it · markdown-it

  High7.5
• CVE-2026-111766

  markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

  markdown-it · markdown-it

  Low3.7
• CVE-2026-111759

  markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes

  markdown-it · markdown-it

  High7.5
• CVE-2026-48801

  linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop

  markdown-it · linkify-it

  High8.7
• CVE-2026-59887

  linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

  markdown-it · linkify-it

  High7.5
• CVE-2026-48988

  markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

  markdown-it · markdown-it

  Medium5.3
• CVE-2025-7969

  Markdown-it 14.1.0 - Cross-site scripting (XSS)

  markdown-it · markdown-it

  Medium6.9
• CVE-2022-21670

  Uncontrolled Resource Consumption in markdown-it

  markdown-it · markdown-it

  Medium5.3