[From nobody Sun Jun 28 16:25:05 2026
Received: (at submit) by bugs.debian.org; 18 Jun 2026 19:01:25 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-10.9 required=4.0 tests=BAYES_00,FOURLA,
 FROMDEVELOPER,MD5_SHA1_SUM,NO_RELAYS,XMAILER_REPORTBUG autolearn=ham
 autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 29; hammy, 149; neutral, 48; spammy,
 1. spammytokens:0.941-+--H*r:bugs.debian.org
 hammytokens:0.000-+--H*F:U*carnil, 0.000-+--XDebbugsCc,
 0.000-+--X-Debbugs-Cc, 0.000-+--H*Ad:N*Bug, 0.000-+--HTo:N*Debian
Return-path: <carnil@debian.org>
Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96)
 (envelope-from <carnil@debian.org>) id 1waHzQ-004Wq3-0c
 for submit@bugs.debian.org; Thu, 18 Jun 2026 19:01:24 +0000
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: node-markdown-it: CVE-2026-48988
Message-ID: <178180928288.2638803.9033932853182845300.reportbug@eldamar.lan>
X-Mailer: reportbug 13.2.0
Date: Thu, 18 Jun 2026 21:01:22 +0200
Delivered-To: submit@bugs.debian.org

Source: node-markdown-it
Version: 22.2.3+dfsg+~12.2.3-4
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for node-markdown-it.

CVE-2026-48988[0]:
| markdown-it is a Markdown parser. Versions 14.1.1 and below contain
| a denial-of-service vulnerability when typographer: true is enabled,
| due to quadratic (O(n^2)) processing in the smartquotes rule. The
| issue stems from repeatedly modifying strings with replaceAt(),
| which performs O(n) slicing and concatenation per quote character.
| This can cause excessive CPU consumption when parsing quote-heavy,
| user-supplied markdown and may let attackers degrade or disrupt
| service availability. Although typographer is disabled by default,
| many production apps enable it for smart typography, making the
| issue relevant. This issue has been fixed in version 14.2.0.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-48988
    https://www.cve.org/CVERecord?id=CVE-2026-48988
[1] https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq
[2] https://github.com/markdown-it/markdown-it/commit/9ce2087562c45d1e5ddd9f76b990f4b3fbe040e5

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore
]