CVE-2026-111759 markdown-it CVE debrief

Who should care

Defenders responsible for applications using the markdown-it library with the `typographer` option enabled should assess exposure and prioritize upgrading to a patched version or disabling the smartquotes rule.

Why it matters

CVE-2026-111759 is a denial-of-service vulnerability in markdown-it that can cause performance degradation or crashes under specially crafted input when the `typographer` option is enabled. Defenders should prioritize upgrading to a patched version or mitigating the issue.

• Denial of service through increased processing time
• Potential performance degradation under specially crafted input

Technical summary

The markdown-it library has a denial-of-service vulnerability when the `typographer` option is enabled. Specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to performance degradation or crashes under specially crafted input. The vulnerability is caused by specially crafted Markdown that can cause repeated scans of the entire opener stack, leading to increased processing time. This issue is fixed in versions 15.0.2 and 14.3.2. Defenders should prioritize upgrading to a patched version or disabling the smartquotes rule.

Defensive priority

Defenders should prioritize upgrading to a patched version or disabling the smartquotes rule.

Recommended defensive actions

• Upgrade to version 15.0.2 or 14.3.2
• Disable the smartquotes rule with `md.disable('smartquotes')`
• Disable typography with `typographer: false`
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by specially crafted Markdown that can cause quadratic processing time in the smartquotes rule when `typographer: true` is enabled. The issue is fixed in versions 15.0.2 and 14.3.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.