CVE-2026-48801
linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.
| CWE | CWE-1333 |
| Vendor | markdown-it |
| Product | linkify-it |
| Published | Jul 14, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for markdown-it linkify-it
Be the first to know when new unknown vulnerabilities affecting markdown-it linkify-it are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
markdown-it / linkify-it
< 5.0.1