CVE-2026-53428: Unbounded Memory Allocation Vulnerability in mdex Package
Summary
CVE-2026-53428: Unbounded memory allocation in highlight_lines range expansion in mdex. Affects mdex across 3 version ranges.
>= 0.11.0, < 0.12.3
>= 956528c5e31746253347029e810a969ab916fd27, < 798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3
>= a8407611715d1ead35fbcba79c72cef1b7df387b, < 6ed94d905f97af188323f042698ae841c02293b4
Fixed in 0.12.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mdex is an open-source library designed for rendering Markdown into HTML, with features that include syntax highlighting for code blocks. It allows users to customize the rendering process through decorators and options. However, a recent vulnerability has been identified that exposes the library to denial of service attacks due to unbounded memory allocation when processing user-controlled input.
Vulnerability Detail
The vulnerability arises from the function comrak_nif::lumis_adapter::LumisAdapter::parse_highlight_lines in the mdex package, which expands a user-defined line range for code block highlighting into a vector without any upper limit. An attacker can exploit this by providing a Markdown input with a highlight_lines decorator that specifies an excessively large range, leading to significant memory allocation. This can result in the exhaustion of host memory, causing the application to crash and deny service to all users. The vulnerability affects versions of mdex from 0.11.0 to below 0.12.3 and mdex_native from 0.1.0 to below 0.2.3.
How To Fix
Latest published version: 0.14.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid enabling code-block decorators by leaving the github_pre_lang and full_info_string render options unset. This prevents the parsing of highlight_lines specifications, thus mitigating the risk of exploitation.
Conclusion
The CVE-2026-53428 vulnerability in the mdex package poses a significant risk due to unbounded memory allocation, which can lead to denial of service. It is crucial for users to update to the patched versions of the package or implement the recommended workarounds to mitigate potential exploitation.
See every vulnerability recorded for mdex →
FAQ
CVE-2026-53428 is a vulnerability in the mdex package that allows for unbounded memory allocation, potentially leading to denial of service.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
Versions of mdex from 0.11.0 to below 0.12.3 are vulnerable to this issue.
If you cannot update the package, consider implementing the provided workaround by disabling code-block decorators in your Markdown rendering options.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for mdex.
