markdown-it vulnerabilitiesmarkdown-it: known vulnerabilities and safe versions
npm: markdown-it
markdown-it has 12 known vulnerability records: 8 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses) and 4 only in Retire.js (CDN builds and advisories without a CVE).
By branch: 15.x is safe from 15.0.3; 14.x is safe from 14.3.3; 13.x has no fixed release in the records; 12.x has no fixed release in the records.
Vulnerabilities and safe version by branch
Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.
| Branch | Support | Latest on branch | Records | Safe version |
|---|---|---|---|---|
| 15.x | — | — | 4high | 15.0.3 |
| 14.x | — | — | 6high | 14.3.3 |
| 13.x | — | — | 6high | No fix |
| 12.x | — | — | 6high | No fix |
| 10.x | — | — | 6high | No fix |
| 4.x | — | — | 9high | No fix |
| 3.x | — | — | 8high | No fix |
Support dates appear only for libraries that endoflife.date tracks.
Records
Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.
CVE-2026-1117582026-10-20
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
Affected versions: >= 14.1.0, < 14.3.3 · >= 15.0.0, < 15.0.3
high 7.5
Fixed in: 14.3.3, 15.0.3
CVE-2026-1117662026-10-19
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
Affected versions: < 14.3.3 · >= 15.0.0, < 15.0.3
low 3.7
Fixed in: 14.3.3, 15.0.3
CVE-2026-1117592026-10-19
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
Affected versions: >= 15.0.0, < 15.0.2 · < 14.3.2
high 7.5
Fixed in: 14.3.2, 15.0.2
GHSA-253c-mchw-3w2r2026-09-29
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
Affected versions: >= 15.0.0, < 15.0.1 · < 14.3.1
medium
Fixed in: 14.3.1, 15.0.1
CVE-2026-489882026-06-17
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
Affected versions: < 14.2.0
medium 5.3
Fixed in: 14.2.0
CVE-2026-23272026-02-12
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the
Affected versions: >= 13.0.0, < 14.1.1
medium 5.5
Fixed in: 14.1.1
high 7.5
Fixed in: 3.0.0
EPSS 1%
medium 5.3
Fixed in: 12.3.2
EPSS 2.2%
CVE-2015-32952017-06-07
markdown-it before 4.1.0 does not block data: URLs.
Affected versions: < 4.1.0
medium 5.3
Fixed in: 4.1.0
EPSS 1.2%
no CVE
Cross-site Scripting (XSS)
Affected versions: >= 4.0.0, < 4.3.1
medium
Fixed in: 4.3.1
no CVE
Fixed crash/infinite loop caused by linkify inline rule
Affected versions: < 13.0.2
medium
Fixed in: 13.0.2
no CVE
Regular Expression Denial of Service (ReDoS)
Affected versions: < 10.0.0
medium
Fixed in: 10.0.0
Sources and method
Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.
This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.
Data as of October 28, 2026.