CVE-2026-53429: mdex Memory Leak Vulnerability Leading to Denial of Service
Summary
CVE-2026-53429: Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of service. Affects mdex across 3 version ranges.
>= 0.11.0, < 0.12.3
>= 81e4d14dd3aa5b206e395c7f372b9b413793015f, < 6ed94d905f97af188323f042698ae841c02293b4
>= 956528c5e31746253347029e810a969ab916fd27, < cbd927fb5061b488de8d90a8ef6df65718ca1fe6
Fixed in 0.12.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mdex is an open-source library designed for rendering documents, particularly in the context of web applications. It allows developers to convert structured data into HTML format efficiently. However, a critical vulnerability has been identified in mdex and its native counterpart, mdex_native, which can lead to severe memory management issues.
Vulnerability Detail
The vulnerability arises from a missing release of memory after the effective lifetime of certain operations within the mdex and mdex_native libraries. Specifically, when rendering documents containing escaped-tag nodes, the native rendering code leaks memory indefinitely. Each rendering operation involving these nodes consumes memory that is never reclaimed, leading to unbounded memory exhaustion. This can be exploited by an attacker who controls the content of the rendered document, potentially causing a denial of service by exhausting the available memory of the system.
How To Fix
Latest published version: 0.14.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid rendering documents that contain escaped-tag nodes until you can update to the patched versions of mdex and mdex_native. Additionally, consider implementing input validation to restrict user-supplied content from including such nodes.
Conclusion
The CVE-2026-53429 vulnerability in mdex and mdex_native poses a significant risk due to unbounded memory leaks during document rendering. It is crucial for developers to update to the latest patched versions to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for mdex →
FAQ
CVE-2026-53429 is a vulnerability in the mdex and mdex_native libraries that allows for unbounded memory leaks during document rendering, potentially leading to denial of service.
If your application uses mdex or mdex_native to render user-supplied content, it may be susceptible to this vulnerability, allowing attackers to exhaust system memory.
As a temporary measure, avoid rendering documents with escaped-tag nodes and validate user input to mitigate the risk of exploitation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 6.9, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for mdex.
