gfm-wasm

GitHub-flavored Markdown to safe HTML, powered by cmark-gfm compiled to WebAssembly. One small .wasm, no native modules, no generated glue. The same renderer runs on Node, Deno, Bun, Cloudflare Workers, and in the browser.

Output is sanitized by default: cmark-gfm runs in safe mode, so raw HTML is dropped and unsafe link schemes like javascript: and data:text/html are stripped. Untrusted Markdown stays harmless.

import { init, render } from 'gfm-wasm';
import wasm from 'gfm-wasm/wasm';

await init(wasm);
render('# Hello **world**'); // "<h1>Hello <strong>world</strong></h1>\n"

The gfm-wasm/wasm import resolves to the bundled module in whatever form your platform provides, and init accepts all of them. The snippet above runs as-is in Node, Deno, Bun, and the browser.

Install

npm install gfm-wasm

A prebuilt cmark.wasm is bundled, so there is no compiler or toolchain to set up.

API

init(source): Promise<void>

Instantiates the wasm. Call it once, await it, then render. source is anything you can load the module from:

• string or URL, fetched for you
• Response, or a promise resolving to one
• ArrayBuffer or a typed array of raw bytes
• a compiled WebAssembly.Module or WebAssembly.Instance

render(markdown): string

Renders Markdown to HTML, synchronously. Returns '' for empty input, and throws if called before init resolves.

Cloudflare Workers

Workers compile the wasm at deploy time, so instantiate once per isolate and reuse it across requests:

import { init, render } from 'gfm-wasm';
import wasm from 'gfm-wasm/wasm';

let ready: Promise<void> | undefined;

export default {
  async fetch(req: Request): Promise<Response> {
    ready ??= init(wasm);
    await ready;
    return new Response(render(await req.text()), {
      headers: { 'content-type': 'text/html; charset=utf-8' },
    });
  },
};

[!TIP] If your build fails to load the WebAssembly module, add the following rule to wrangler.json to ensure .wasm files are handled correctly.

{
  "rules": [
    {
      "type": "CompiledWasm",
      "globs": ["gfm-wasm/wasm"],
      "fallthrough": true
    }
  ]
}

Build from source

The published package already ships the wasm. To rebuild it, install the Emscripten SDK and run make. The output lands in dist/cmark.wasm.

License

MIT for this wrapper. cmark-gfm is © GitHub under its own license.