Description
When typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input.
Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack.
Recommendation
Update the markdown-it package to the latest compatible version. Followings are version details:
Affected version(s): **< 14.3.2 >= 15.0.0, < 15.0.2** Patched version(s): **14.3.2 15.0.2**
References
Could your website be exposed too?
SmartScanner can check your website for markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes and gives you actionable findings to investigate.
Start a free scanRelated Issues
- markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations - CVE-2026-48988
- markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled - CVE-2026-111766
- markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression - CVE-2026-111758
- linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text - CVE-2026-59887
You might also like:
See something that needs correcting? Let us knowUpdated October 20, 2026