# CVE-2026-111759: markdown-it quadratic ReDoS in smartquotes

Source: https://junglewise.ai/threats/cve-2026-111759-markdown-it-is-a-markdown-parser-prior-to-14-3-2-and-15-0-2-when  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-111759 · Severity: high · CVSS 7.5 · Published 2026-10-19

markdown-it is a Markdown parsing library used to convert Markdown text into HTML. When the typographer option is enabled, specially crafted Markdown input can cause excessive processing time, potentially crashing or degrading performance of applications that parse untrusted content—a denial-of-service attack. The default configuration is not vulnerable, but this option is commonly enabled by developers.

Technologies: [Markdown-It](https://junglewise.ai/threats/technologies/markdown-it-markdown-it), [markdown-it (npm)](https://junglewise.ai/threats/technologies/markdown-it). Vendors: [Markdown-It](https://junglewise.ai/threats/vendors/markdown-it), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-111759 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111759 being exploited in the wild.

**How severe is CVE-2026-111759?** High severity, with a CVSS score of 7.5, published 19 October 2026.

**Which products and versions are affected?** Markdown-It before 14.3.2 and 15.0.2; markdown-it (npm) >= 15.0.0, < 15.0.2, SEMVER:introduced=15.0.0,fixed=15.0.2.

**Is there a fix for CVE-2026-111759?** Yes. markdown-it (npm): upgrade to 15.0.2 or later. Until then: Disable the typographer option (set typographer: false) until upgrade is possible, or restrict parsing of untrusted Markdown input to content with bounded complexity. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111759 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111759?** Check whether you run Markdown-It or markdown-it (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- markdown-it (npm): upgrade to 15.0.2 or later

  ```sh
  npm install markdown-it@15.0.2
  ```


Disable the typographer option (set typographer: false) until upgrade is possible, or restrict parsing of untrusted Markdown input to content with bounded complexity.

## Technical details

A quadratic complexity vulnerability exists in the smartquotes rule when typographer is enabled. Attackers can craft Markdown with many opening double quotes followed by unmatched closing single quotes (or vice versa), forcing the parser to repeatedly scan the entire opener stack. This results in algorithmic denial of service against applications processing untrusted Markdown input. The issue is fixed by limiting the smartquotes stack and correcting the quote-matching logic.

## Affected products

- markdown-it markdown-it before 14.3.2 and 15.0.2

## Identifiers

- CVE-2026-111759
- GHSA-r7fv-28h4-cvq7

## Timeline

- 2026-10-19: disclosed

## References

- [https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670](https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670)
- [https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152](https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152)

## Related threats

- [markdown-it quadratic-time rendering of unclosed link reference](https://junglewise.ai/threats/cve-2026-111758-markdown-it-quadratic-time-rendering-of-a-single-multi-line-link)
- [markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled](https://junglewise.ai/threats/cve-2026-111766-markdown-it-is-a-markdown-parser-prior-to-14-3-3-and-15-0-3-when)
- [markdown-it quadratic performance degradation in linkify processing](https://junglewise.ai/threats/markdown-it-linkify-true-has-two-quadratic-paths-so-a-few-hundred-kb-of-a1cf8480)
- [markdown-it denial of service in smartquotes rule](https://junglewise.ai/threats/cve-2026-48988-markdown-it-denial-of-service-in-smartquotes-rule)
- [markdown-it ReDoS in linkify regex](https://junglewise.ai/threats/cve-2026-2327-markdown-it-redos-in-linkify-function)