# markdown-it (npm) vulnerabilities 8 known vulnerabilities (2 high, 4 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 15.0.3 (Oct 16, 2026): no advisory affects it - Newest unaffected release: 15.0.3 (Oct 16, 2026), the latest release - Weekly downloads: 38.7M - Dependents: 837 - Releases: 89 since 2.0.0 (Dec 19, 2014) - Registry: https://www.npmjs.com/package/markdown-it - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-111758: 14.1.0 to 14.3.2 (14.3.3 is outside it); 15.0.0 to 15.0.2 (15.0.3 is outside it) - CVE-2026-111766: 2.0.0 to 14.3.2 (14.3.3 is outside it); 15.0.0 to 15.0.2 (15.0.3 is outside it) - CVE-2026-111759: 2.0.0 to 14.3.1 (14.3.2 is outside it); 15.0.0 to 15.0.1 (15.0.2 is outside it) - CVE-2026-48988: 2.0.0 to 14.1.1 (14.2.0 is outside it) - CVE-2026-2327: 13.0.0 to 14.1.0 (14.1.1 is outside it) - CVE-2025-7969: 14.1.0 (14.1.1 is outside it) - CVE-2015-10005: 2.0.0 to 2.2.1 (3.0.0 is outside it) - CVE-2022-21670: 2.0.0 to 12.3.1 (12.3.2 is outside it) ## Advisories (8) ### [CVE-2026-111758](https://cve.now/CVE-2026-111758): markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) - Severity: High 7.5 - Published: Oct 20, 2026 - Affected: from 14.1.0, fixed in 14.3.3; from 15.0.0, fixed in 15.0.3. - Fixed in 14.3.3 (released Oct 16, 2026, 4 days before disclosure) and 15.0.3 (released Oct 16, 2026, 4 days before disclosure). - The latest release, 15.0.3, is not affected. - 55% of markdown-it downloads last week were affected versions (23.8M). ### [CVE-2026-111766](https://cve.now/CVE-2026-111766): markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled - Severity: Low 3.7 - Published: Oct 19, 2026 - Affected: fixed in 14.3.3; from 15.0.0, fixed in 15.0.3. - Fixed in 14.3.3 (released Oct 16, 2026, 3 days before disclosure) and 15.0.3 (released Oct 16, 2026, 3 days before disclosure). - The latest release, 15.0.3, is not affected. - 69% of markdown-it downloads last week were affected versions (29.8M). ### [CVE-2026-111759](https://cve.now/CVE-2026-111759): markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes - Severity: High 7.5 - Published: Oct 19, 2026 - Affected: from 15.0.0, fixed in 15.0.2; fixed in 14.3.2. - Fixed in 14.3.2 (released Sep 12, 2026, 37 days before disclosure) and 15.0.2 (released Sep 11, 2026, 38 days before disclosure). - The latest release, 15.0.3, is not affected. - 61% of markdown-it downloads last week were affected versions (26.4M). ### [CVE-2026-48988](https://cve.now/CVE-2026-48988): markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations - Severity: Medium 5.3 - Published: Jun 17, 2026 - Affected: fixed in 14.2.0. - Fixed in 14.2.0 (released May 23, 2026, 25 days before disclosure). - The latest release, 15.0.3, is not affected. - 43% of markdown-it downloads last week were affected versions (18.6M). ### [CVE-2026-2327](https://cve.now/CVE-2026-2327): Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to… - Severity: Medium 6.9 - Published: Feb 12, 2026 - Affected: from 13.0.0, fixed in 14.1.1. - Fixed in 14.1.1 (released Feb 11, 2026, 1 day before disclosure). - The latest release, 15.0.3, is not affected. - 21% of markdown-it downloads last week were affected versions (9.2M). ### [CVE-2025-7969](https://cve.now/CVE-2025-7969): Markdown-it 14.1.0 - Cross-site scripting (XSS) - Severity: Medium 6.9 - Published: Aug 21, 2025 - Affected: versions 14.1.0. - Fixed in 14.1.1 (released Feb 11, 2026, 174 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 15.0.3, is not affected. - 18% of markdown-it downloads last week were affected versions (7.7M). ### [CVE-2015-10005](https://cve.now/CVE-2015-10005): markdown-it html\_re.js redos - Severity: Low 3.5 - Published: Dec 27, 2022 - Affected: fixed in 3.0.0. - Fixed in 3.0.0 (released Jan 4, 2015, 2914 days before disclosure). - The latest release, 15.0.3, is not affected. - <0.1% of markdown-it downloads last week were affected versions (215). ### [CVE-2022-21670](https://cve.now/CVE-2022-21670): Uncontrolled Resource Consumption in markdown-it - Severity: Medium 5.3 - Published: Jan 10, 2022 - Affected: fixed in 12.3.2. - Fixed in 12.3.2 (released Jan 8, 2022, 2 days before disclosure). - The latest release, 15.0.3, is not affected. - 5% of markdown-it downloads last week were affected versions (2.1M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/markdown-it Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.