Is markdown-it 15.0 vulnerable?
npm · 4 releases from 15.0.0 to 15.0.3 · latest markdown-it is 15.0.3 · checked 1 Nov 2026
No known advisories in the last release
markdown-it 15.0.3, the last 15.0 release, has no known advisories. 4 advisories affect earlier 15.0.x releases, so update to 15.0.3.
npm install markdown-it@15.0.3Fixed within 15.0.x, affecting earlier releases
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
- Affected
- >=14.1.0 <14.3.3 · >=15.0.0 <15.0.3
- Fixed in
- 14.3.3, 15.0.3
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
- Affected
- <14.3.3 · >=15.0.0 <15.0.3
- Fixed in
- 14.3.3, 15.0.3
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
- Affected
- >=15.0.0 <15.0.2 · <14.3.2
- Fixed in
- 14.3.2, 15.0.2
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
- Affected
- >=15.0.0 <15.0.1 · <14.3.1
- Fixed in
- 14.3.1, 15.0.1
Which of your client projects are still on markdown-it 15.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact markdown-it version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other markdown-it versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.