5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48988

CVE-2026-48988: markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48988

CVE-2026-48988:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
markdown-it	npm	<= 14.1.1	14.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the smartquotes rule of markdown-it, specifically within the lib/rules_core/smartquotes.mjs file. The analysis of the patch between the vulnerable version (14.1.1) and the patched version (14.2.0) confirms the details provided in the advisory. The commit 9ce2087562c45d1e5ddd9f76b990f4b3fbe040e5 directly addresses the performance issue.

The root cause is the replaceAt function, which performs string replacement inefficiently through slicing and concatenation. This function has a time complexity of O(n) for a single operation. The process_inlines function iterates over quote characters in a given text token and calls replaceAt for each one. When an attacker provides a long string of quote characters (e.g., 160,000 quotes), this results in the O(n) replaceAt function being called O(n) times, leading to an overall quadratic complexity of O(n^2).

The patch completely removes the replaceAt function and replaces the logic in process_inlines. Instead of modifying the string in-place, the new implementation collects all the required replacements in an array and then builds the new string in a single pass using the applyReplacements helper. This changes the algorithm's complexity to O(n), effectively mitigating the Denial of Service vulnerability.

Vulnerable functions

replaceAt

lib/rules_core/smartquotes.mjs

The `replaceAt` function is the core of the vulnerability. It was used to replace characters in a string by slicing the string into two parts and concatenating them with the new character. When called repeatedly in a loop on a large string, this operation has a quadratic time complexity (O(n^2)), leading to a denial of service.

process_inlines

lib/rules_core/smartquotes.mjs

The `process_inlines` function was responsible for iterating through the text and calling the vulnerable `replaceAt` function for each quotation mark found. This repeated invocation of an O(n) operation within a loop is what triggered the O(n^2) behavior, making this function a key part of the exploitation path.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.