Skip to main content
cve.nowby Sazabi
← npm
npmPackage

markdown-it

8 known vulnerabilities (2 high, 4 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
15.0.3 (Oct 16, 2026): no advisory affects it
Newest unaffected release
15.0.3 (Oct 16, 2026), the latest release
Advisories
8 · 2 high, 4 medium, 2 low
Weekly downloads
38.7M
Dependents
837
Releases
89 since 2.0.0 (Dec 19, 2014)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-111758
    Affects 14.1.0 to 14.3.2 (14.3.3 is outside it); 15.0.0 to 15.0.2 (15.0.3 is outside it)
  • CVE-2026-111766
    Affects 2.0.0 to 14.3.2 (14.3.3 is outside it); 15.0.0 to 15.0.2 (15.0.3 is outside it)
  • CVE-2026-111759
    Affects 2.0.0 to 14.3.1 (14.3.2 is outside it); 15.0.0 to 15.0.1 (15.0.2 is outside it)
  • CVE-2026-48988
    Affects 2.0.0 to 14.1.1 (14.2.0 is outside it)
  • CVE-2026-2327
    Affects 13.0.0 to 14.1.0 (14.1.1 is outside it)
  • CVE-2025-7969
    Affects 14.1.0 (14.1.1 is outside it)
  • CVE-2015-10005
    Affects 2.0.0 to 2.2.1 (3.0.0 is outside it)
  • CVE-2022-21670
    Affects 2.0.0 to 12.3.1 (12.3.2 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

  • markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

    Affected: from 14.1.0, fixed in 14.3.3; from 15.0.0, fixed in 15.0.3.

    Fixed in 14.3.3 (released Oct 16, 2026, 4 days before disclosure) and 15.0.3 (released Oct 16, 2026, 4 days before disclosure).

    The latest release, 15.0.3, is not affected.

    55% of markdown-it downloads last week were affected versions (23.8M).

  • markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

    Affected: fixed in 14.3.3; from 15.0.0, fixed in 15.0.3.

    Fixed in 14.3.3 (released Oct 16, 2026, 3 days before disclosure) and 15.0.3 (released Oct 16, 2026, 3 days before disclosure).

    The latest release, 15.0.3, is not affected.

    69% of markdown-it downloads last week were affected versions (29.8M).

  • markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes

    Affected: from 15.0.0, fixed in 15.0.2; fixed in 14.3.2.

    Fixed in 14.3.2 (released Sep 12, 2026, 37 days before disclosure) and 15.0.2 (released Sep 11, 2026, 38 days before disclosure).

    The latest release, 15.0.3, is not affected.

    61% of markdown-it downloads last week were affected versions (26.4M).

  • CVE-2026-48988Medium 5.3

    markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

    Affected: fixed in 14.2.0.

    Fixed in 14.2.0 (released May 23, 2026, 25 days before disclosure).

    The latest release, 15.0.3, is not affected.

    43% of markdown-it downloads last week were affected versions (18.6M).

  • CVE-2026-2327Medium 6.9

    Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to…

    Affected: from 13.0.0, fixed in 14.1.1.

    Fixed in 14.1.1 (released Feb 11, 2026, 1 day before disclosure).

    The latest release, 15.0.3, is not affected.

    21% of markdown-it downloads last week were affected versions (9.2M).

  • CVE-2025-7969Medium 6.9

    Markdown-it 14.1.0 - Cross-site scripting (XSS)

    Affected: versions 14.1.0.

    Fixed in 14.1.1 (released Feb 11, 2026, 174 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 15.0.3, is not affected.

    18% of markdown-it downloads last week were affected versions (7.7M).

  • markdown-it html_re.js redos

    Affected: fixed in 3.0.0.

    Fixed in 3.0.0 (released Jan 4, 2015, 2914 days before disclosure).

    The latest release, 15.0.3, is not affected.

    <0.1% of markdown-it downloads last week were affected versions (215).

  • CVE-2022-21670Medium 5.3

    Uncontrolled Resource Consumption in markdown-it

    Affected: fixed in 12.3.2.

    Fixed in 12.3.2 (released Jan 8, 2022, 2 days before disclosure).

    The latest release, 15.0.3, is not affected.

    5% of markdown-it downloads last week were affected versions (2.1M).