CVE-2026-48988 markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
Attackers can cause denial of service via CPU exhaustion in markdown-it when the typographer option is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48988?
CVE-2026-48988 is a medium-severity denial of service vulnerability in markdown-it, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.
Weakness: CWE-400
Which versions are affected by CVE-2026-48988?
2 open source packages ship an affected version, including markdown-it. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
markdown-it npm | All versions | 14.2.0 |
markdown-it npm | All versions | 14.2.0 |
Products include Markdown-It Project Markdown-It.
How do I fix CVE-2026-48988?
Upgrade markdown-it to 14.2.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-48988 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48988 exists.
Other vulnerabilities in markdown-it
Sources
Also known as CLEANSTART-2026-EO06774, CLSA-2026-1787916789, CLSA-2026-1790161417, CLSA-2026-1790598013, CLSA-2026-1792369116, CLSA-2026-1792451528 and 16 more.