Is markdown-it 8.4 vulnerable?
npm · 3 releases from 8.4.0 to 8.4.2 · latest markdown-it is 15.0.3 · checked 2 Nov 2026
Yes: 5 known advisories
Yes. markdown-it 8.4.2, the last 8.4 release, is affected by 5 known security advisories (1 high, 3 medium, 1 low), including CVE-2026-111759, CVE-2026-48988, CVE-2022-21670. Upgrade to 14.3.3 or later to fix all of them.
npm install markdown-it@14.3.3Advisories affecting markdown-it 8.4.2
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
- Affected
- <14.3.3 · >=15.0.0 <15.0.3
- Fixed in
- 14.3.3, 15.0.3
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
- Affected
- >=15.0.0 <15.0.2 · <14.3.2
- Fixed in
- 14.3.2, 15.0.2
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
- Affected
- >=15.0.0 <15.0.1 · <14.3.1
- Fixed in
- 14.3.1, 15.0.1
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
- Affected
- <14.2.0
- Fixed in
- 14.2.0
Uncontrolled Resource Consumption in markdown-it
- Affected
- <12.3.2
- Fixed in
- 12.3.2
Which of your client projects are still on markdown-it 8.4?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact markdown-it version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other markdown-it versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.