CVE-2024-28243 KaTeX's maxExpand bypassed by \edef

Medium 6.5 Published 25 Mar 2024 Updated 5 Feb 2026

Attackers can cause denial of service in KaTeX by bypassing expansion limits with malicious TeX input, leading to resource exhaustion.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-28243?

CVE-2024-28243 is a medium-severity denial of service vulnerability in KaTeX, published on 25 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

Weakness: CWE-674

Which versions are affected by CVE-2024-28243?

2 open source packages ship an affected version, including katex. It affects 1 product.

Package	Affected	Fixed in
`katex` npm	From `0.12.0`	`0.16.10`
`katex` npm	From `0.12.0`	`0.16.10`

Products include Katex Katex.

How do I fix CVE-2024-28243?

Upgrade katex to 0.16.10 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-28243 being exploited?

There is no known exploitation of CVE-2024-28243 in the wild and no public exploit code.

Sources

Also known as CLSA-2026-1792231998, DEBIAN-CVE-2024-28243, GHSA-64fm-8hw2-v72w, UBUNTU-CVE-2024-28243.