# CVE-2026-48988: markdown-it denial of service in smartquotes rule

Source: https://junglewise.ai/threats/cve-2026-48988-markdown-it-denial-of-service-in-smartquotes-rule  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-48988 · Severity: medium · CVSS 5.3 · Published 2026-06-17

markdown-it is a widely used library for converting Markdown text into HTML. A flaw in its typography feature allows an attacker to send a specially crafted document that causes the system to consume excessive CPU power. This can lead to a denial-of-service (DoS) condition, making the application slow or completely unresponsive for legitimate users.

Technologies: [markdown-it (npm)](https://junglewise.ai/threats/technologies/markdown-it). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-48988 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48988 being exploited in the wild.

**How severe is CVE-2026-48988?** Medium severity, with a CVSS score of 5.3, published 17 June 2026.

**Which products and versions are affected?** markdown-it (npm) <= 14.1.1, SEMVER:introduced=0,fixed=14.2.0.

**Is there a fix for CVE-2026-48988?** Yes. markdown-it (npm): upgrade to 14.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48988 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48988?** Check whether you run markdown-it (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- markdown-it (npm): upgrade to 14.2.0 or later

  ```sh
  npm install markdown-it@14.2.0
  ```


## Technical details

A denial-of-service vulnerability exists in markdown-it versions 14.1.1 and below due to uncontrolled resource consumption in the smartquotes rule. When the 'typographer' option is enabled, the parser uses a replaceAt() helper function that performs string slicing and concatenation (an O(n) operation) for every quote character found. In inputs with a high density of quotation marks, this results in quadratic (O(n^2)) time complexity. A remote, unauthenticated attacker can exploit this by submitting a markdown payload with many consecutive quotes, leading to CPU exhaustion and service degradation. The issue is fixed in version 14.2.0 by optimizing how string replacements are handled.

## Affected products

- markdown-it markdown-it <= 14.1.1

## Identifiers

- CVE-2026-48988
- GHSA-6v5v-wf23-fmfq

## Timeline

- 2026-05-23: advisory: GitHub Security Advisory published
- 2026-06-17: disclosed: CVE-2026-48988 published to NVD
- 2026-06-17: patched: Fixed in version 14.2.0

## References

- [https://github.com/markdown-it/markdown-it/commit/9ce2087562c45d1e5ddd9f76b990f4b3fbe040e5](https://github.com/markdown-it/markdown-it/commit/9ce2087562c45d1e5ddd9f76b990f4b3fbe040e5)
- [https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq](https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq)

## Related threats

- [markdown-it quadratic-time rendering of unclosed link reference](https://junglewise.ai/threats/cve-2026-111758-markdown-it-quadratic-time-rendering-of-a-single-multi-line-link)
- [markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled](https://junglewise.ai/threats/cve-2026-111766-markdown-it-is-a-markdown-parser-prior-to-14-3-3-and-15-0-3-when)
- [markdown-it quadratic ReDoS in smartquotes](https://junglewise.ai/threats/cve-2026-111759-markdown-it-is-a-markdown-parser-prior-to-14-3-2-and-15-0-2-when)
- [markdown-it ReDoS in linkify regex](https://junglewise.ai/threats/cve-2026-2327-markdown-it-redos-in-linkify-function)
- [markdown-it inefficient regular expression complexity](https://junglewise.ai/threats/cve-2015-10005-markdown-it-inefficient-regular-expression-complexity)