CVE-2026-53426: MDEx Package Denial-of-Service Vulnerability via Atom Table Exhaustion
Summary
CVE-2026-53426: Atom-table exhaustion denial-of-service via JSON parse_document in MDEx. Affects mdex across 2 version ranges.
>= 0.4.3, < 0.13.2
>= cbb59a3f792dbc343873adec3466f49c853dc309, < 00fddf444220a1f1cc0af0a1cab6738804878387
Fixed in 0.13.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MDEx is a library designed for parsing and manipulating Markdown and JSON documents in Elixir applications. It provides functionalities to convert documents into structured formats, allowing developers to work with content more effectively. However, the library is vulnerable to a denial-of-service attack due to its handling of JSON input, particularly when it comes to atom creation, which can lead to resource exhaustion.
Vulnerability Detail
The vulnerability arises from the MDEx.parse_document function, which accepts a JSON source. The internal json_to_node function uses an attacker-controlled node_type value to create new atoms via String.to_atom. Since atoms in the BEAM virtual machine are not garbage collected, a maliciously crafted JSON document can generate a large number of unique atoms, potentially exhausting the atom table limit of approximately 1,048,576. This can cause the Erlang VM to abort, resulting in a denial-of-service condition that affects all processes on the node.
How To Fix
Latest published version: 0.14.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.13.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Avoid passing untrusted or attacker-controlled input to the {:json, ...} source of MDEx.parse_document/2. Instead, consider using the {:markdown, ...} source, which is not affected by this vulnerability.
Conclusion
CVE-2026-53426 represents a significant vulnerability in the MDEx package that can lead to denial-of-service attacks through atom table exhaustion. It is crucial for developers using this library to update to the patched version or implement workarounds to protect their applications from potential exploitation.
See every vulnerability recorded for mdex →
FAQ
CVE-2026-53426 is a vulnerability in the MDEx package that allows for denial-of-service attacks through atom table exhaustion.
If your application uses the MDEx package and processes untrusted JSON input, it may be susceptible to denial-of-service attacks, causing the Erlang VM to crash.
The vulnerability affects MDEx versions from 0.4.3 up to, but not including, 0.13.2.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
As a temporary measure, avoid using the {:json, ...} source in MDEx.parse_document/2 with untrusted input to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for mdex.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
