MDEx.parse_document/2 uses a JSON source that internally maps the 'node_type' value to an Erlang atom without limits. Each unique value creates a persistent atom, and a crafted JSON document can spur hundreds of thousands of atoms, overwhelming the default atom table (~1,048,576). When the table capacity is exceeded, the BEAM VM terminates, bringing all processes under the node to a halt. The flaw is unauthenticated and allows any untrusted JSON payload to trigger a denial‑of‑service.

The vulnerability applies to the MDEx library owned by leandrocp, affecting any version from 0.4.3 up to but not including 0.13.2. All software that passes third‑party JSON to MDEx.parse_document via the :json source is vulnerable.

The CVSS score of 8.2 reflects a high severity impact, while EPSS data is unavailable, indicating no quantified likelihood analysis yet. The vulnerability is not listed in CISA KEV. An attacker can exploit the flaw simply by delivering a crafted JSON payload to the MDEx parser; no authentication or privileged access is required, so the attack vector is unauthenticated remote input. Because atoms are not garbage collected, the denial‑of‑service is permanent for the life of the VM until a restart.