CVE-2026-54888 Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "comrak_nif",
      "'Elixir.MDEx'",
      "'Elixir.MDEx.Native'"
    ],
    "packageName": "mdex",
    "packageURL": "pkg:hex/mdex",
    "product": "mdex",
    "programFiles": [
      "native/comrak_nif/src/types/document.rs",
      "lib/mdex.ex",
      "lib/mdex/native.ex"
    ],
    "programRoutines": [
      {
        "name": "comrak_nif::types::document::ex_document_to_comrak_ast"
      },
      {
        "name": "comrak_nif::types::document::comrak_ast_to_ex_document"
      },
      {
        "name": "'Elixir.MDEx':parse_document!/1"
      },
      {
        "name": "'Elixir.MDEx':to_html/1"
      },
      {
        "name": "'Elixir.MDEx.Native':document_to_html_with_options/2"
      }
    ],
    "repo": "https://github.com/leandrocp/mdex",
    "vendor": "leandrocp",
    "versions": [
      {
        "lessThan": "0.12.3",
        "status": "affected",
        "version": "0.3.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "comrak_nif",
      "'Elixir.MDEx'",
      "'Elixir.MDEx.Native'"
    ],
    "packageName": "leandrocp/mdex",
    "packageURL": "pkg:github/leandrocp/mdex",
    "product": "mdex",
    "programFiles": [
      "native/comrak_nif/src/types/document.rs",
      "lib/mdex.ex",
      "lib/mdex/native.ex"
    ],
    "programRoutines": [
      {
        "name": "comrak_nif::types::document::ex_document_to_comrak_ast"
      },
      {
        "name": "comrak_nif::types::document::comrak_ast_to_ex_document"
      },
      {
        "name": "'Elixir.MDEx':parse_document!/1"
      },
      {
        "name": "'Elixir.MDEx':to_html/1"
      },
      {
        "name": "'Elixir.MDEx.Native':document_to_html_with_options/2"
      }
    ],
    "repo": "https://github.com/leandrocp/mdex",
    "vendor": "leandrocp",
    "versions": [
      {
        "lessThan": "6ed94d905f97af188323f042698ae841c02293b4",
        "status": "affected",
        "version": "d0bc7d55177727c61d188ef465178ab3b81f4f2c",
        "versionType": "git"
      }
    ]
  },
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "mdex_native_nif",
      "'Elixir.MDExNative.Native'"
    ],
    "packageName": "mdex_native",
    "packageURL": "pkg:hex/mdex_native",
    "product": "mdex_native",
    "programFiles": [
      "native/mdex_native_nif/src/types/document.rs",
      "lib/mdex_native/native.ex"
    ],
    "programRoutines": [
      {
        "name": "mdex_native_nif::types::document::ex_document_to_comrak_ast"
      },
      {
        "name": "mdex_native_nif::types::document::comrak_ast_to_ex_document"
      },
      {
        "name": "'Elixir.MDExNative.Native':parse_document/2"
      },
      {
        "name": "'Elixir.MDExNative.Native':document_to_html_with_options/2"
      }
    ],
    "repo": "https://github.com/leandrocp/mdex_native",
    "vendor": "leandrocp",
    "versions": [
      {
        "lessThan": "0.2.3",
        "status": "affected",
        "version": "0.1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "mdex_native_nif",
      "'Elixir.MDExNative.Native'"
    ],
    "packageName": "leandrocp/mdex_native",
    "packageURL": "pkg:github/leandrocp/mdex_native",
    "product": "mdex_native",
    "programFiles": [
      "native/mdex_native_nif/src/types/document.rs",
      "lib/mdex_native/native.ex"
    ],
    "programRoutines": [
      {
        "name": "mdex_native_nif::types::document::ex_document_to_comrak_ast"
      },
      {
        "name": "mdex_native_nif::types::document::comrak_ast_to_ex_document"
      },
      {
        "name": "'Elixir.MDExNative.Native':parse_document/2"
      },
      {
        "name": "'Elixir.MDExNative.Native':document_to_html_with_options/2"
      }
    ],
    "repo": "https://github.com/leandrocp/mdex_native",
    "vendor": "leandrocp",
    "versions": [
      {
        "lessThan": "947696c47bc22bea5dffc0f78c946fa6b70ce183",
        "status": "affected",
        "version": "956528c5e31746253347029e810a969ab916fd27",
        "versionType": "git"
      }
    ]
  }
]