Hi,

The following vulnerability was published for node-markdown-it.

CVE-2026-111759[0]:
| markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when
| typographer: true is enabled, specially crafted Markdown can cause
| quadratic processing time in the smartquotes rule, potentially
| leading to denial of service in applications processing untrusted
| input. Many opening double quotes followed by unmatched closing
| single quotes cause repeated scans of the entire opener stack. The
| same issue occurs with the quote types reversed. The default
| configuration (typographer: false) is not affected, but this option
| is enabled with high probability. This issue is fixed in versions
| 14.3.2 and 15.0.2.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-111759
https://www.cve.org/CVERecord?id=CVE-2026-111759
[1] https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore