# CVE-2026-54888: leandrocp mdex uncontrolled recursion in Markdown parsing

Source: https://junglewise.ai/threats/cve-2026-54888-leandrocp-mdex-uncontrolled-recursion-in-markdown-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-54888 · Severity: info · CVSS 6.9 · Published 2026-06-29

A vulnerability in the mdex Markdown processing library can allow an attacker to crash an entire Elixir or Erlang application. By providing a specially crafted Markdown document with deeply nested elements, an attacker can trigger a system-level failure that the application cannot recover from. This results in a complete denial of service for all users and processes running on the affected server node.

Technologies: [Leandrocp Mdex](https://junglewise.ai/threats/technologies/mdex), [Leandrocp Mdex Native](https://junglewise.ai/threats/technologies/mdex-native). Vendors: [Leandrocp](https://junglewise.ai/threats/vendors/leandrocp).

## Quick answers

**Is CVE-2026-54888 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54888 being exploited in the wild.

**How severe is CVE-2026-54888?** Informational severity, with a CVSS score of 6.9, published 29 June 2026.

**Which products and versions are affected?** Leandrocp Mdex 0.3.0 before 0.12.3; Leandrocp Mdex Native 0.1.0 before 0.2.3.

**Is there a fix for CVE-2026-54888?** A patch was published on 2026-06-19: Initial patch commit in mdex_native repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54888 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-54888?** Check whether you run Leandrocp Mdex or Leandrocp Mdex Native at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an uncontrolled recursion (CWE-674) located in the Rust NIF (Native Implemented Function) component of the mdex library. Specifically, the functions `ex_document_to_comrak_ast` and `comrak_ast_to_ex_document` in `document.rs` lack nesting depth limits when converting between Elixir structs and Comrak's internal AST. An attacker can provide a Markdown document with thousands of nested block quotes to exhaust the native C stack, triggering an uncatchable SIGSEGV. Because this occurs within a NIF, it bypasses the Erlang runtime's fault tolerance and terminates the entire BEAM process. The issue was fixed by replacing recursive logic with an iterative, stack-based conversion in mdex 0.12.3 and mdex_native 0.2.3.

## Affected products

- leandrocp mdex 0.3.0 before 0.12.3
- leandrocp mdex_native 0.1.0 before 0.2.3

## Timeline

- 2026-06-19: patched: Initial patch commit in mdex_native repository
- 2026-06-29: advisory: CVE published and NVD record created

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-54888.html](https://cna.erlef.org/cves/CVE-2026-54888.html)
- [https://github.com/leandrocp/mdex_native/commit/947696c47bc22bea5dffc0f78c946fa6b70ce183](https://github.com/leandrocp/mdex_native/commit/947696c47bc22bea5dffc0f78c946fa6b70ce183)
- [https://github.com/leandrocp/mdex_native/security/advisories/GHSA-3w4f-53g2-f66p](https://github.com/leandrocp/mdex_native/security/advisories/GHSA-3w4f-53g2-f66p)

## Related threats

- [leandrocp mdex denial of service via unbounded memory allocation](https://junglewise.ai/threats/cve-2026-53428-leandrocp-mdex-denial-of-service-via-unbounded-memory-allocation)