AIKIDO-2026-549894
markdown-it is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
markdown-itTL;DR
markdown-it's smartquotes rule rescans the entire opener stack from the top for every closing quote when quote types are mismatched, so many opening double quotes followed by unmatched closing single quotes (or the reverse) trigger repeated full-stack scans under typographer: true. Inputs built from mismatched quote pairs make render time grow quadratically, stalling the parser for seconds on inputs of only a few hundred KB. The fix tracks the most recent opener of each quote type separately and caps the opener stack at 1000 entries, so a closing quote resolves without rescanning unrelated openers.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable typographer: true.
Background info
markdown-it is vulnerable to Denial of Service (DoS) in versions 2.0.0 - 14.3.1 and 15.0.0 - 15.0.1.
How to fix this
Upgrade the markdown-it library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.