CVE-2025-59717 is a medium severity (CVSS 5.4) type confusion in the npm package @digitalocean/do-markdownit through 1.16.1. If allowedClasses or allowedEnvironments is a string and not an array, matching becomes substring matching. Pass arrays and check for a newer release. The sections below cover who is affected, how to check, and what to do now.
What's affected
The record says the npm package @digitalocean/do-markdownit is affected through version 1.16.1, in its callout and fence_environment plugins. It does not give a fixed version, and I could not confirm one, so check the package's releases on npm and GitHub for anything newer than 1.16.1.
The condition is specific: it applies when your configuration passes allowedClasses or allowedEnvironments as a string rather than an array.
How to check if you're exposed
Find the package in your dependency tree and read your own configuration.
npm ls @digitalocean/do-markdownit
npm view @digitalocean/do-markdownit version
Then search your code for where the plugins are configured:
grep -rnE "allowedClasses|allowedEnvironments" --include=*.js --include=*.ts .
If the values are arrays of exact strings, the condition in the record does not apply to your setup.
What to do now
- Find every use of @digitalocean/do-markdownit, including transitive ones.
- Make sure allowedClasses and allowedEnvironments are always arrays of exact values, never single strings.
- Check npm for a release newer than 1.16.1 and upgrade if one addresses this.
- Keep an HTML sanitiser in front of rendered Markdown that comes from users.
- Add a unit test that fails if the configuration type changes.
Why it matters
The record maps this to CWE-843, access of a resource using an incompatible type. In JavaScript, calling includes on a string checks for a substring, while calling it on an array checks for an exact element. The plugins assumed an array. Pass a string and a value like a longer class name that merely contains an allowed name would pass the check.
It is a small bug with a clear lesson. Allow lists that look strict can be quietly loosened by a type mistake in configuration. The score is 5.4 because exploitation needs high complexity and a specific configuration. It is not on the CISA KEV list. A TypeScript type or a runtime check on the option would make this class of mistake impossible.
Safeguard can help you find this one in your own software. The free in-browser dependency scan at gold.safeguard.sh/scan reads your manifest or lockfile and shows which known vulnerabilities your declared dependencies carry, including transitive ones. Reachability analysis then helps you separate the places where your code actually calls the affected component from the places where it only sits in the tree, which makes it easier to decide what to patch first.
Quick check
Am I affected if I pass arrays?
According to the record, the issue arises when the options are strings and not arrays, so correct array configuration avoids the substring behaviour.
Is there a fixed release?
None is listed in the record and I could not confirm one. Check the package's releases.
Sources
- npm package page (listed in the record)
- Project repository
- NVD record data
Last reviewed: 18 October 2026.
