Uncontrolled Recursion vulnerability in leandrocp mdex

mdex is a popular Elixir wrapper around the Rust comrak Markdown parser, exposed via a NIF (Native Implemented Function). The vulnerability lives in two mutually recursive Rust functions that translate between the %MDEx.Document{} Elixir struct and Comrak's internal AST. Neither function enforces a depth limit, so an attacker who supplies a document with thousands of nested constructs (block quotes, lists, emphasis) drives the recursion off the native C stack. Affected versions: 0.8.3 through < 0.13.2. Fixed in 0.13.2, which adds a configurable document_depth_limit.

There is no vendor CVSS for this CVE — we are establishing the first severity. The instinct is to dismiss this as 'just a DoS,' but the failure mode is unusually severe: a NIF stack overflow raises an uncatchable SIGSEGV that the BEAM cannot trap. The entire OS process dies, taking every Erlang/Elixir process on the node with it — every tenant, every websocket, every background worker. For any Phoenix app that renders untrusted markdown (CMS comments, chat, AI-generated content, Beacon CMS pages), this is a single-packet kill switch. That is materially worse than a typical request-scoped DoS, and it justifies a HIGH assessment.

Why this verdict

• Unauthenticated, single-packet kill. No prior compromise stage required — attacker only needs a render endpoint. That's a zero-friction precondition.
• NIF blast radius is the multiplier. A normal markdown DoS scopes to one request. This one scopes to the entire OS process, dropping every Erlang process on the node. That's why it sits above MEDIUM despite being 'just DoS'.
• Role multiplier: typical role (Phoenix web tier rendering user content). Chain succeeds; blast radius = node-wide outage, multi-tenant if multi-tenant app. Not fleet-scale, not identity-scale.
• Role multiplier: Beacon CMS / public-facing Phoenix CMS. Chain succeeds; blast radius = full site outage on every node behind LB via replay. Still availability-only.
• Role multiplier: internal admin tool rendering trusted markdown. Chain may or may not succeed depending on input source; blast radius limited to a low-criticality service. This is the role that keeps the verdict below CRITICAL.
• No code execution, no data confidentiality/integrity loss. Ceiling is availability. That prevents promotion to CRITICAL even with the NIF amplification.
• EPSS and KEV are low, but both systematically discount DoS — they describe exploitation prevalence, not impact-when-exploited. We weight them low here.

Why not higher?

CRITICAL is reserved for chains ending in code execution, credential theft, or supply-chain pivot. This caps at availability impact. There is no path from a stack overflow inside the comrak AST converter to memory corruption that the attacker can shape — the BEAM process simply dies. Without an RCE primitive or identity/secret exposure, CRITICAL overstates the impact.

Why not lower?

MEDIUM would be appropriate for a request-scoped markdown DoS where the framework catches the exception and returns 500. This isn't that — the SIGSEGV is uncatchable inside the NIF and kills the BEAM OS process, so one POST equals one dead node and every co-tenant on it. That blast-radius amplification, combined with zero authentication and a one-line payload, lifts it firmly above MEDIUM.

1. Upgrade mdex to >= 0.13.2 and set document_depth_limit: 100 — The definitive fix. mix deps.update mdex, redeploy. Per noisgate mitigation SLA for HIGH this is ≤ 30 days; remediation ≤ 180 days. Treat this as the same step — there is no reason to delay the patch behind a mitigation.
2. Hard-cap markdown input length at the controller boundary — Reject any markdown body > 64KB (or whatever fits your product) BEFORE it reaches MDEx.to_html/1. Wraps a byte_size/1 guard in your Plug/controller. Deploy within 3 days as a belt-and-suspenders measure while rolling out the upgrade fleet-wide.
3. Add a WAF rule rejecting >1000 consecutive >, *, -, or # characters — Cloudflare/Akamai/AWS WAF custom rule. Catches the obvious payload shape without parsing markdown. Costs nothing, deploys in minutes, buys you cover while the upgrade rolls.
4. Move markdown rendering into an isolated worker pool — If feasible, render markdown inside an Oban/Broadway worker rather than the request-serving node. A SIGSEGV in the worker still kills its BEAM, but the user-facing nodes survive. Architectural change — pursue in parallel with the patch, not as a blocker.
5. Tighten systemd / k8s restart policy and add SIGSEGV alerting — Ensure Restart=always with RestartSec=2s (systemd) or pod restartPolicy Always with fast liveness probes (k8s). Add a SIEM rule alerting on repeated BEAM SIGSEGVs from the same source IP — that's your exploitation signal.

Run on each Phoenix/Elixir host or in CI against your build artifact. Invoke as ./check_mdex.sh /path/to/app_release (the deployed release dir containing mix.lock or releases/*/). Needs read access to the lockfile only — no privileges. Alternatively run from your project root with no args.

#!/usr/bin/env bash
# noisgate verification: CVE-2026-54888 — mdex uncontrolled recursion DoS
# Vulnerable: mdex >= 0.8.3, < 0.13.2
# Patched:    mdex >= 0.13.2
set -u

TARGET="${1:-.}"
LOCK=""

for candidate in "$TARGET/mix.lock" "$TARGET"/releases/*/runtime.exs "$TARGET"/releases/*/start.boot; do
  [ -f "$candidate" ] && LOCK="$candidate" && break
done

if [ -z "$LOCK" ] && [ -f "$TARGET/mix.lock" ]; then
  LOCK="$TARGET/mix.lock"
fi

if [ -z "$LOCK" ]; then
  # Last resort: look for compiled beam metadata
  BEAM=$(find "$TARGET" -name 'Elixir.MDEx.beam' 2>/dev/null | head -n1)
  if [ -z "$BEAM" ]; then
    echo "UNKNOWN: no mix.lock or MDEx beam under $TARGET"
    exit 2
  fi
  echo "UNKNOWN: MDEx beam present at $BEAM but no mix.lock to read version"
  exit 2
fi

VER=$(grep -E '"mdex"' "$LOCK" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)

if [ -z "$VER" ]; then
  echo "PATCHED: mdex not present in $LOCK"
  exit 0
fi

# semver compare against 0.13.2 and 0.8.3
awk -v v="$VER" 'BEGIN {
  split(v, a, ".");
  cur = a[1]*10000 + a[2]*100 + a[3];
  lo  = 0*10000 + 8*100 + 3;     # 0.8.3
  fix = 0*10000 + 13*100 + 2;    # 0.13.2
  if (cur >= lo && cur < fix) {
    printf "VULNERABLE: mdex %s (need >= 0.13.2)\n", v; exit 1;
  } else {
    printf "PATCHED: mdex %s\n", v; exit 0;
  }
}'
exit $?

Sources

1. leandrocp/mdex GitHub repository
2. mdex CHANGELOG
3. mdex Releases
4. Erlang Ecosystem Foundation CNA — Issued CVEs
5. CWE-674: Uncontrolled Recursion
6. GitHub Advisory Database
7. Hex.pm — mdex package
8. Comrak (upstream Rust parser)