Is CVE-2026-111759 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111759 being exploited in the wild.

How severe is CVE-2026-111759?

High severity, with a CVSS score of 7.5, published 19 October 2026.

Which products and versions are affected?

Markdown-It before 14.3.2 and 15.0.2; markdown-it (npm) >= 15.0.0, < 15.0.2, SEMVER:introduced=15.0.0,fixed=15.0.2.

How is CVE-2026-111759 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111759?

Check whether you run Markdown-It or markdown-it (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111759: markdown-it quadratic ReDoS in smartquotes

Q: Is there a fix for CVE-2026-111759?

Yes. markdown-it (npm): upgrade to 15.0.2 or later. Until then: Disable the typographer option (set typographer: false) until upgrade is possible, or restrict parsing of untrusted Markdown input to content with bounded complexity. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-111759 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-111759?

Check whether you run Markdown-It or markdown-it (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111759 · Severity: high · CVSS 7.5 · Published 2026-10-19

markdown-it is a Markdown parsing library used to convert Markdown text into HTML. When the typographer option is enabled, specially crafted Markdown input can cause excessive processing time, potentially crashing or degrading performance of applications that parse untrusted content—a denial-of-service attack. The default configuration is not vulnerable, but this option is commonly enabled by developers.

Technologies: Markdown-It, markdown-it (npm). Vendors: Markdown-It, npm.

Quick answers

Is CVE-2026-111759 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111759 being exploited in the wild.
How severe is CVE-2026-111759?: High severity, with a CVSS score of 7.5, published 19 October 2026.
Which products and versions are affected?: Markdown-It before 14.3.2 and 15.0.2; markdown-it (npm) >= 15.0.0, < 15.0.2, SEMVER:introduced=15.0.0,fixed=15.0.2.
Is there a fix for CVE-2026-111759?: Yes. markdown-it (npm): upgrade to 15.0.2 or later. Until then: Disable the typographer option (set typographer: false) until upgrade is possible, or restrict parsing of untrusted Markdown input to content with bounded complexity. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111759 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111759?: Check whether you run Markdown-It or markdown-it (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

markdown-it (npm): upgrade to 15.0.2 or later
```
npm install markdown-it@15.0.2
```

Disable the typographer option (set typographer: false) until upgrade is possible, or restrict parsing of untrusted Markdown input to content with bounded complexity.

Technical details

A quadratic complexity vulnerability exists in the smartquotes rule when typographer is enabled. Attackers can craft Markdown with many opening double quotes followed by unmatched closing single quotes (or vice versa), forcing the parser to repeatedly scan the entire opener stack. This results in algorithmic denial of service against applications processing untrusted Markdown input. The issue is fixed by limiting the smartquotes stack and correcting the quote-matching logic.

Affected products

markdown-it markdown-it before 14.3.2 and 15.0.2

Identifiers

CVE-2026-111759
GHSA-r7fv-28h4-cvq7

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.