Is markdown-it 14.2 vulnerable?
npm · 1 release from 14.2.0 to 14.2.0 · latest markdown-it is 15.0.3 · checked 1 Nov 2026
Yes: 4 known advisories
Yes. markdown-it 14.2.0, the last 14.2 release, is affected by 4 known security advisories (2 high, 1 medium, 1 low), including CVE-2026-111758, CVE-2026-111759, CVE-2026-111766. Upgrade to 14.3.3 or later to fix all of them.
npm install markdown-it@14.3.3Advisories affecting markdown-it 14.2.0
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
- Affected
- >=14.1.0 <14.3.3 · >=15.0.0 <15.0.3
- Fixed in
- 14.3.3, 15.0.3
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
- Affected
- <14.3.3 · >=15.0.0 <15.0.3
- Fixed in
- 14.3.3, 15.0.3
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
- Affected
- >=15.0.0 <15.0.2 · <14.3.2
- Fixed in
- 14.3.2, 15.0.2
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
- Affected
- >=15.0.0 <15.0.1 · <14.3.1
- Fixed in
- 14.3.1, 15.0.1
Which of your client projects are still on markdown-it 14.2?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact markdown-it version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other markdown-it versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.