CVE-2026-54888: Uncontrolled Recursion in mdex Leads to Denial of Service
Summary
CVE-2026-54888: Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex. Affects mdex across 3 version ranges.
>= 0.3.0, < 0.12.3
>= 956528c5e31746253347029e810a969ab916fd27, < 947696c47bc22bea5dffc0f78c946fa6b70ce183
>= d0bc7d55177727c61d188ef465178ab3b81f4f2c, < 6ed94d905f97af188323f042698ae841c02293b4
Fixed in 0.12.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mdex is an Elixir library designed for converting Markdown documents into structured formats and vice versa. It utilizes Comrak's internal Abstract Syntax Tree (AST) for processing Markdown. The library is widely used for rendering Markdown in Elixir applications, making it essential for developers who require Markdown support in their projects. However, a critical vulnerability exists that allows for denial of service through deeply nested Markdown inputs.
Vulnerability Detail
The vulnerability arises from uncontrolled recursion in the mdex library, specifically in the conversion functions ex_document_to_comrak_ast and comrak_ast_to_ex_document. These functions do not enforce a maximum nesting depth, allowing an attacker to craft a Markdown document with excessive nested block quotes. This leads to unbounded recursion, which can exhaust the native C stack and result in a stack overflow. The overflow triggers an uncatchable SIGSEGV signal, causing the BEAM process to terminate and affecting all Elixir and Erlang processes on the node. No special privileges or authentication are required to exploit this vulnerability.
How To Fix
Latest published version: 0.14.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can validate and sanitize Markdown input to limit nesting depth before processing it with mdex. This can be done by implementing a custom parser that checks for excessive nesting and rejects such inputs.
Conclusion
CVE-2026-54888 is a significant vulnerability in the mdex library that can lead to denial of service through uncontrolled recursion. It is crucial for developers using this library to update to the patched versions to mitigate the risk. Additionally, implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for mdex →
FAQ
CVE-2026-54888 is a vulnerability in the mdex library that allows for denial of service through uncontrolled recursion in Markdown processing.
If your application uses the mdex library, an attacker can exploit this vulnerability to crash the BEAM process, affecting all Elixir and Erlang processes running on the node.
mdex versions from 0.3.0 before 0.12.3 are affected by this vulnerability.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for mdex.
